How to Verify File Integrity with SHA-256

Why verify at all

When you download an installer or a system image, the vendor usually publishes a SHA-256 value. Comparing it confirms two things: the file was not corrupted in transit and was not tampered with.

Three steps

1. Find the published SHA-256 value on the official page, do not compare against their MD5 or SHA-1 value.
2. Compute the SHA-256 of the file you actually have.
3. Compare character by character; it must match exactly.

The three most common pitfalls

• Wrong algorithm: the vendor published both MD5 and SHA-256 and you compared the wrong one.
• Untrusted source: if the download page was hijacked, the published value is fake too. Prefer HTTPS official sources.
• "Close enough" thinking: a hash must match exactly; one differing character means a different file.

Computing locally in the browser

The browser Web Crypto API keeps the file on your device: fast, and never exposes the installer to a third party. Larger files take proportionally longer.

Command cheat sheet

Checksums vs digital signatures

A checksum proves the file did not change, but not that it came from the vendor, the value lives on the same website, so a compromised site invalidates the comparison. A digital signature (GPG or a code-signing certificate) is verified with a public key and proves integrity and origin. For system images and packages, check signatures.

Mismatch, but the file works?

• Confirm which file the published value belongs to, the same name often ships for several architectures (x64 / arm64);
• Confirm the download completed and was not truncated by a browser or proxy (compare sizes);
• Confirm no stray spaces, line breaks or case differences slipped into the comparison;
• If everything is ruled out and it still mismatches, do not install it; re-download from the official source.

Batch and automation

When several files need checking, put "expected hash + file path" into a list and let a script compute and compare each one, printing a pass/fail table instead of comparing by eye:

# values.txt: one "expected-hash file-path" per line
while read -r expect file; do
  actual=$(sha256sum "$file" | awk '{print $1}')
  [ "$expect" = "$actual" ] && echo "OK   $file" || echo "FAIL $file"
done < values.txt

For continuous delivery, emit the hash list when artefacts are built and compare automatically before deployment, move verification earlier in the pipeline.

Try them: file hash checker (drop a file), hashing (text)