Why you'd check a file's hash
A checksum is a fixed-length fingerprint computed from a file's exact bytes — change even one bit anywhere in the file and the checksum comes out completely different. Software publishers post the SHA-256 hash of a release next to the download link precisely so you can confirm the file you got is the file they actually built: unchanged by a bad download, a compromised mirror, or tampering somewhere along the way.
How to use it
- Drop in the file you downloaded — the hash is computed from its bytes using the browser's own
crypto.subtle.digest, the same cryptographic primitive used by real security software, not a reimplementation. - Paste the checksum the publisher posted into the comparison field.
- A match means the file is byte-for-byte what they published. Any difference — even one character — means it is not, and you should not run or trust that file.
What a mismatch actually tells you
It does not tell you the file is malicious — the far more common cause is an incomplete download, especially on a slow or unstable connection, where the file gets silently truncated. It can also mean you copied the wrong published hash, or the download came from an unofficial mirror serving something different from the real release. Any of these is a reason to re-download from the original source before proceeding, not a reason to panic — but also not a reason to ignore.
Why SHA-256 specifically
SHA-256 is the algorithm software distributors overwhelmingly use for this purpose today. Older formats like MD5 and SHA-1 are still seen on older download pages, but both have known collision weaknesses — it is computationally feasible to construct two different files with the same MD5 or SHA-1 hash, which defeats the whole point of using it to prove authenticity. SHA-256 has no such known weakness and is the current standard for this use.