Practical hash guide · October 18, 2026
Verify a download without guessing which checksum to use
Match the release, algorithm and complete digest before deciding whether a downloaded file agrees with its publisher's reference.
Start with the exact file and a trustworthy reference
The expected checksum must describe the exact file you downloaded. A project may publish separate packages for Windows, macOS and Linux, different processor architectures, and several release versions. Check the version and filename before opening the calculator. A SHA-256 value for a ZIP archive will not match an executable extracted from that ZIP.
Obtain the reference from the publisher's release or download page. When the publisher provides a signed checksum file, follow its signature-verification instructions as well. A digest alone does not establish who published it, and a matching value from an untrusted source cannot make that source trustworthy.
Calculate first, then compare the expected value
LocalHash verifies against the results already calculated. Generate the hash before pasting the expected value into the verification panel. Changing the selected file, text or algorithm clears the previous results and comparison so an old result is not confused with a new input.
- Select the algorithm named by the publisher. SHA-256, SHA-512 and SHA3-256 are different comparisons.
- Choose the completed download in File mode. A file that is still downloading is not ready to verify.
- Choose Generate and wait until the result appears. If the browser reports an unavailable algorithm, do not treat the missing result as a match.
- Paste the hexadecimal digest into Expected hash. If a checksum line includes a filename or label, copy only its digest portion.
- Choose Verify hash and inspect the matching algorithm as well as the comparison result.
- Keep the full value with the filename, release version, algorithm and reference URL in your verification record.
Interpret the comparison correctly
A matching SHA-256 digest is strong evidence that the downloaded bytes agree with the trusted reference. It does not scan the file for malware or establish that a program is safe to run. If the values differ, check the release details before downloading again. Hashing the wrong architecture twice will reproduce the same mismatch.
Compare the complete digest rather than a few characters at either end. Hexadecimal letter case is not a substantive difference: uppercase A and lowercase a represent the same digit. A nearly matching value, however, is still a mismatch.
Use an independent Windows calculation when helpful
PowerShell provides Get-FileHash for a second calculation on the same saved file. Replace the example path with the file you actually downloaded. Its SHA256 spelling names the same SHA-256 algorithm selected in LocalHash. The PowerShell output may use uppercase hexadecimal letters.
Agreement between two calculators checks the calculation on those bytes. The separate question remains whether the expected digest came from the correct, trusted release.
Get-FileHash -LiteralPath '.\download.zip' -Algorithm SHA256