How to verify a downloaded file with SHA-256 and handle a mismatch

You need two inputs: the downloaded file and a reference SHA-256 checksum published for that exact release artifact. Calculate the file's digest locally and compare the complete strings. A match provides strong practical evidence of integrity relative to the reference; a mismatch means the file has not passed the check.

Open the file checksum tool, choose the downloaded file and paste the published SHA-256 into the comparison field. Fileify reads the file locally in chunks, does not upload it to a server, and reports an explicit match or mismatch.

Step 1: get the reference from the publisher

Look for SHA-256 beside the download, on the release page, or in a file named something like SHA256SUMS. Confirm that it belongs to the exact artifact:

• the same version;
• the same operating system and architecture;
• the same package format, such as ZIP, ISO or installer;
• the same release filename.

Do not rely on a digest copied from an unrelated comment, mirror or message. If an attacker can replace both the download and the checksum shown beside it, a matching pair does not establish who published the file.

Step 2: calculate SHA-256 locally

Select the original download before extracting or resaving it. Even a small change will almost certainly produce a different digest.

Fileify calculates SHA-256, SHA-1 and MD5 in the browser. Compare the same algorithm that the publisher names: a SHA-256 result cannot be matched against an MD5 or SHA-1 reference. SHA-256 is preferable for new publications. A legacy catalogue may publish only SHA-1 or MD5, in which case verification requires calculating that published algorithm.

The tool reads the file block by block and reports progress. There is no fixed app-level file-size cap, although speed and the practical limit still depend on the device, browser and available memory.

Step 3: compare the complete strings

Copy the whole reference. A SHA-256 digest is commonly displayed as 64 hexadecimal characters. The comparison field normalises letter case plus leading and trailing whitespace, so uppercase and lowercase hex representations compare equally.

Do not compare only the first and last groups by eye. Similar edges do not mean the middle matches. Use the tool's full-string match result.

What a match proves — and what it does not

A matching SHA-256 digest provides strong practical evidence that the selected file corresponds to the published reference. This can detect an incomplete download, storage corruption or an unexpected replacement.

A checksum is not a digital signature. It does not identify the creator of the file. The reference must come through a trusted official channel for the result to say anything useful about origin. When a publisher provides a signed checksum list or a separate signature, verify it with the publisher's recommended process as an additional step.

Why a checksum may not match

Check the routine causes before drawing a conclusion:

1. You downloaded a different release, architecture or package variant.
2. The page now shows a new release checksum while your file is older.
3. The browser renamed the file; a rename alone does not affect the hash.
4. The file was extracted, repacked or resaved. Verify the exact artifact the reference describes.
5. The download failed or the file changed during transfer or storage.

Do not run a mismatched installer or open an untrusted archive. Delete the questionable copy, download the correct variant again from the official address, and repeat the check. If it still fails, review the publisher's notices or contact its support channel.

Pre-run checklist

• The reference came from an official page or a verified signed list.
• Version, platform, architecture and artifact name all match.
• You selected the original file before extraction or modification.
• You calculated the same algorithm that the publisher specified.
• The complete digest was compared.
• A mismatched file was not run and was downloaded again.

Keep the release URL with the checksum if you may repeat the check later. A digest without context does not identify which version or artifact it belongs to.