Check a download's SHA-256 without losing track of its source

By Hello Keyboard (AI-assisted)

A download page offers an archive and a long SHA-256 value. Before opening the archive, you can calculate its digest and compare the two values. Keep a second question beside that result: what makes the expected digest trustworthy?

This walkthrough separates the comparison from the evidence about its source, then uses three tiny practice files to make the distinction concrete.

Identify the exact download

Record the release version, operating system, architecture and filename beside the expected checksum. A project's Windows installer, Linux archive and source-code archive can all belong to one release while containing different bytes.

If the checksum describes a ZIP file, hash that downloaded ZIP. Extracting it and hashing a file inside answers a different question. Repacking the same documents can also change the archive's bytes.

Start from the publisher's official release instructions rather than a checksum copied from an unrelated comment. When the publisher provides a signed checksum list, follow its signature-verification procedure, including how to establish trust in the signing key.

Calculate and compare the complete digest

The Hello Keyboard File Hash Comparison Tool has a Choose a file control, an Expected SHA-256 digest (optional) field and a Compute and compare button. Its documentation lists a 100 MiB file limit.

Select the intended file and enter the expected 64 hexadecimal characters. Copy only the digest, excluding any accompanying filename or algorithm label. Compare the complete value rather than a short beginning or ending. Do not substitute a SHA-512 or MD5 checksum.

For confidential material or files beyond the documented limit, use an approved local utility. Microsoft's Get-FileHash documentation describes hashing file contents and selecting SHA256 explicitly. Renaming a file alone leaves its content digest unchanged.

Try a four-byte example

If Python 3 is already available, run this in a new, empty practice folder. It creates three files; using an empty folder avoids overwriting existing names.

from pathlib import Path
from hashlib import sha256

samples = {
    "practice-a.bin": bytes([0, 1, 2, 255]),
    "practice-copy.bin": bytes([0, 1, 2, 255]),
    "practice-change.bin": bytes([0, 1, 3, 255]),
}
for name, data in samples.items():
    Path(name).write_bytes(data)
    print(name, sha256(data).hexdigest())

Python's hashlib reference documents the SHA-256 constructor and hexadecimal output. The first two files have different names but identical contents. Both produce:

3d1f57c984978ef98a18378c8166c1cb8ede02c03eeb6aee7e2f121dfeee3e56

The third changes one byte and produces:

f1b7b27ead7a1985c4ba2fea85fcb281544632c4a852bbd41a2b3455596eda4a

Use the first digest as the expected value for all three practice files. The first two should match; the third should differ. These values were independently checked with Python and GNU sha256sum. This exercise demonstrates the comparison, without claiming that every possible pair of files has a unique hash.

Check what supplied the expected value

A matching digest is strong evidence that the bytes agree with the reference represented by that digest. An attacker who replaces both a download and its displayed checksum can make that comparison pass. A hash calculation alone supplies no publisher identity or malware verdict.

Ubuntu's image-verification instructions illustrate the additional work: establish trust in the signing key, verify the signed checksum file, then compare the downloaded image against its authenticated checksum. Follow the current instructions for your actual publisher; a valid signature from an unknown key does not establish the identity you intended to trust.

If a comparison fails, stop before running the download. Recheck the algorithm, release, selected file and copied digest. Resolve the discrepancy through the publisher's official instructions rather than accepting a near match.

Save the filename, calculated digest, expected-digest source and verification result together. That makes a later review more useful than a screenshot saying only “match.”

Disclosure: This original tutorial was prepared by an AI assistant on behalf of the Hello Keyboard operator. It contains one affiliated tool link. The synthetic calculations were checked locally on 9 November 2026; the website interface was read, not interactively tested for this draft. These checks are not an independent product review or a privacy or security audit.