How to Verify a Downloaded File With a SHA-256 Checksum

A SHA-256 checksum is a fingerprint calculated from a file's contents. Compute it for the source and for the downloaded copy, then compare the complete values. A match is strong evidence that the two files contain the same bytes.

This is useful for large archives, video masters, datasets, and other deliveries where opening the file or checking its size is not enough. Two files can have the same name and size while containing different data.

Get the expected value from the sender

Ask the sender to calculate the checksum after the delivery file is finalized. They should identify the exact filename and algorithm along with the value. A checksum from an earlier export will not validate a newer version, even if the filenames match.

If tampering is a concern, obtain the expected checksum through a trusted channel. A checksum copied from the same compromised location as a malicious file cannot independently establish who created the file.

Calculate SHA-256 on Windows

Open PowerShell and run the following command, replacing the example path with the downloaded file's actual location:

Get-FileHash -LiteralPath 'C:\Downloads\Delivery_v03.zip' -Algorithm SHA256

The command reads the file and reports its hash; it does not change the file. Keep quotes around paths with spaces. Microsoft's Get-FileHash documentation explains the parameters and supported algorithms.

Wait until the download finishes before calculating the value. Hashing a very large file takes time because its contents must be read. Compare the full SHA-256 value, not just the first few characters. Letter case does not change the hexadecimal value.

Know which file you are comparing

If the sender provides a checksum for a ZIP, calculate the checksum of that ZIP before extracting it. Do not compare a contained video against the archive's hash. Rebuilding an archive can change its bytes even when it contains equivalent documents, so compare the actual delivered archive.

For a folder, ask for a manifest containing a checksum for each file, with its relative path. A checksum for one file does not verify the rest of the directory. Keep the manifest with the delivery record.

Investigate a mismatch

1. Confirm that both parties used SHA-256 and the same delivery version.
2. Check that the download completed and that neither file was edited afterward.
3. Download a fresh copy to a separate location and calculate its checksum.
4. If the mismatch remains, ask the sender to check the uploaded version and regenerate the expected value from that source.

Keep the mismatched copy separate until you understand the cause. Do not overwrite the only known-good original during troubleshooting.

Common questions

Does a matching hash prove a file is safe?

No. It establishes a match to the expected contents, not that those contents are harmless. Source trust and appropriate file handling still matter.

Does renaming a file change its checksum?

Changing only the filename does not change a hash of the file's contents. Editing or re-exporting its contents does. That distinction helps separate delivery naming mistakes from changed data.

If your current delivery workflow is unreliable, compare Filemail alternatives. Keep checksum verification in your process whichever service you choose.