A cryptographic hash function reads file contents and produces a fixed-length value. The same bytes should produce the same value, while even a small change should produce a different result.
Checksums help detect change
Software publishers sometimes provide a SHA-256 checksum next to a download. After downloading the file, you calculate its hash and compare the complete value. A match indicates that your file bytes match the referenced copy.
A mismatch can mean the download is incomplete, corrupted, modified or simply a different version.
A matching hash is not a trust certificate
The checksum is only as trustworthy as the place where you obtained it. If a malicious party can replace both the file and the displayed checksum, the values can still match.
Use checksums from an authenticated official source and verify signatures when a publisher provides them.
Why SHA-256 is commonly used
SHA-256 is part of the SHA-2 family and is widely used for file verification. Older algorithms such as MD5 are still seen for accidental-corruption checks, but they are not preferred where collision resistance matters.
How to compare safely
- Calculate the hash using the same algorithm listed by the publisher.
- Compare every character, not only the beginning or end.
- Confirm that the checksum belongs to the exact version and platform you downloaded.
- Download from the official source whenever possible.
This guide was reviewed for practical clarity and updated for the current NEXDOWNLOAD toolset on July 28, 2026.