What a SHA-256 digest can and cannot prove
Use a digest to compare bytes, while keeping file authenticity and password storage separate from ordinary hashing.
Draft prepared: 2026-10-02. Publisher: GXA Technologies. No named expert review is claimed. AI-assisted draft; human editorial review pending
A fixed-length fingerprint of the input
SHA-256 maps input bytes to a 256-bit digest, commonly displayed as 64 hexadecimal characters. The algorithm is deterministic: the same bytes produce the same digest.
The filename is not the data being summarized when you hash a selected file. Renaming a file without changing its bytes does not change that digest; altering line endings or image metadata can.
Compare the same representation
To verify a downloaded file against a published checksum, choose SHA-256 for the local file and compare all characters with the reference. Do not compare a SHA-256 result with a checksum from another algorithm.
For text, encoding and whitespace matter. The bytes for hello differ from hello followed by a newline. If two systems disagree, check encoding and line endings before assuming the hash implementation failed.
The reference needs its own trust
A checksum copied from the same untrusted location as a malicious file does not prove authenticity. An attacker who can replace both may provide a matching value. Obtain the reference through a channel you trust.
A match is useful evidence that bytes match the reference. It is not a malware scan, license check or guarantee that the file is appropriate to open.
Do not substitute plain hashing for a password system
Hashing is not reversible encoding and is not encryption. It does not provide a decryption operation to retrieve the original input.
This utility is for byte comparison and development checks. Do not design account password storage by saving a plain fast digest from it; that requires a dedicated password-hashing and authentication design.
Report an error in this information
Include the page address and the statement that needs checking. Do not send private files or credentials.