SHA-256 Generator for File Integrity

What File Integrity Hashing Actually Verifies

When you download a binary — a Linux ISO, a Docker image, a release tarball — the publisher typically provides a SHA-256 checksum alongside the download. The hash is a 64-character hex string like e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. You compute the same hash on your downloaded copy. If both match, the file you have is bit-for-bit identical to what the publisher built. If they differ — even by one byte — the file was modified somewhere between the publisher and you.

SHA-256 is the modern standard. SHA-1 has known collision attacks (found in 2017) and is no longer trustworthy for security purposes. MD5 has been broken for over a decade. If a publisher only provides MD5 or SHA-1, treat their integrity guarantees as advisory at best.

How to Verify a Download

1. Download the file.
2. Generate its SHA-256. On macOS/Linux: shasum -a 256 filename. On Windows PowerShell: Get-FileHash filename -Algorithm SHA256. Or paste the file's text content into the tool above for small text files.
3. Compare the result against the publisher's published checksum. They should be identical, character-for-character.
4. Verify the published checksum itself is authentic — typically by checking the publisher's GPG signature on the checksums file. Otherwise an attacker who modified the binary can also modify the displayed checksum.

What Hash Mismatches Actually Mean

Hashes don't match. Three possibilities, in order of likelihood:

• Incomplete download. The file was cut off mid-transfer. Re-download. (Most common cause.)
• Wrong file or version. You downloaded a different release or platform variant than the checksum is for. Confirm the filename matches the checksum file's row.
• Tampering. A man-in-the-middle, compromised mirror, or compromised publisher has substituted a malicious file. Rare, but the entire point of integrity checking is to catch this.

If the hash matches, you've confirmed bit-level integrity. You have not confirmed the publisher is trustworthy — only that the file is what they intended to ship. Authenticity (who built it) requires a signature, not a hash.

SHA-256 vs SHA-512 vs Blake3

SHA-256 is the de facto standard for software integrity in 2026. SHA-512 produces a longer hash (128 hex chars) and is slightly faster on 64-bit CPUs but offers no meaningful security advantage for integrity checking. Blake3 is faster still but isn't yet universally supported by tooling. Stick with SHA-256 unless you have a specific reason to choose otherwise.

Related Tools & Reading

• Generic Hash Generator — MD5, SHA-1, SHA-256, SHA-512
• SHA-256 vs SHA-512 Comparison
• What is Hashing? MD5, SHA-256 Explained
• SHA-256 vs MD5 — Why MD5 Is Broken