If the SHA-256 values match, the two files have the same bytes
SHA-256 is a hash function that reduces a file of any size to one 256-bit (32-byte) summary. It is usually written as 64 hexadecimal characters. The same bytes always give the same value, wherever and whenever you calculate it, and changing even one byte changes most of the 64 characters. So when the SHA-256 value published by the download page equals the value of the file you received, you can conclude that the file was not damaged or swapped for another one on the way.
This tool calculates the SHA-256 of whatever you put in box A, a file or text, and lays the 64 characters next to the reference value from box B in groups of 8. Files are read in 4 MiB pieces inside the browser, so there is no size limit, and even an installer image of several GB can be calculated while you watch the progress. File contents and results are never sent to a server.
The reference box accepts not only a single 64-character value but also a whole checksum list such as SHA256SUMS. The tool looks for the line with the same value, or failing that the line with the same file name, and compares against it. If the values differ, it first tries the usual causes (a line break at the end, Windows line breaks, the Unicode composition form, the value of another hash algorithm) and tells you which one fits.
When to compare hashes
Comparing hashes answers "is this file the same as the original?" in a few seconds. Comparing byte by byte needs the original in your hands, but a hash needs only 64 characters. It is especially useful in situations like these.
- After downloading an operating system image or an installer: Linux distributions and developer tools publish a SHA-256 value or a SHA256SUMS file on the download page. If you used a mirror, or a download was interrupted and resumed, it is safer to check the value first. Ubuntu's own guide says to check the image against SHA256SUMS and then to verify the signature of that list as well.
- When checking that a backup or copy matches the original: files moved with an external drive, a NAS or cloud sync can be damaged even when the name and size are the same. Switch box B to "Other file" and put in the original and the copy. The tool compares the two values and, if they differ, finds the position of the first differing byte.
- After sending or receiving a file: if the sender also shares the 64 characters calculated on their side, the receiver only needs to put in the file to see whether it is the same. Some messengers and social networks recompress photos and videos, so in that case the values will differ.
- When comparing build outputs in development: to see whether builds from the same source are really identical, whether the value for a web page's integrity attribute is right, or whether the example hash in an API document matches your implementation.
- When checking that text is handled the same way: before creating a signature or token, you may want to see whether a string hash equals the one from another program. A single line break byte or a Unicode composition difference is often the cause, and this tool tries those differences to find the one that matches.
How to use it
- In box A, choose or drop a File. To hash text, switch to Text and type. Files are calculated as soon as you choose them, and text as you type.
- Paste the SHA-256 value from the download page into box B. You can also paste a whole checksum list, or load a list file such as SHA256SUMS with "Open a list file". To compare two files, switch box B to Other file.
- The result line says "Match" or "Different". The board below splits the 64 characters into eight groups of 8, puts the calculated value on the top row and the reference value on the bottom row, and highlights the characters that differ.
- If the values differ, look at the list of causes below. In text mode, when a difference such as the final line break makes the text match the reference value, press "Calculate this way" to recalculate with exactly that setting.
- To use the calculated value, choose a copy format (lowercase, uppercase or Base64) and press "Copy value A".
Example values you can check yourself
The values below gave the same result in this tool, in Node.js crypto and in macOS sha256sum. They show that text that looks the same on screen gets a completely different value if its bytes differ. In the table, ↵ is a line break (0A) and ␍↵ is a Windows line break (0D 0A).
| Input | Bytes | SHA-256 | Description |
|---|---|---|---|
(empty) | 0 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | An input with nothing in it, 0 bytes. An empty file gives the same value. |
abc | 3 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | The first example in the NIST example document. |
abc↵ | 4 | edeaaff3f1774ad2888673770c6d64097e391bc362d7d6fb34982ddf0efd18cb | One more byte was added at the end, a line break (0A). |
hello | 5 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 | The same as the result of printf hello or echo -n hello. |
hello↵ | 6 | 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 | The same as the result of echo hello | sha256sum. |
hello␍↵ | 7 | cd2eca3535741f27a8ae40c31b0c41d4057a7a7b912b33b9aed86485d1c84676 | A line that ends with a Windows line break (0D 0A). |
[BOM]hello | 8 | 7489ebbcc2a00056ddaaaac190bce473e5c03696ea1bd8ed83cf59a174283862 | The content of a file that starts with a UTF-8 BOM (EF BB BF). |
é | 2 | 4a99557e4033c3539de2eb65472017cad5f9557f7a0625a09f1c3f6e2ba69c4c | The single precomposed character 'é' (NFC, U+00E9), 2 bytes. |
é | 3 | bf12767b0f2a56b2190075bae8169f656e3ce8d6357d4aff184bc6c7ea48f9f6 | 'é' as 'e' plus a combining accent (NFD, U+0065 U+0301), 3 bytes. It looks exactly like the row above. |
The last two rows are the same "é". macOS may store file names in decomposed form (NFD), so a hash made from a copied file name can differ from the one made on Windows or Linux, for example for "café". With the normalization buttons (NFC and NFD) in text mode you can calculate both versions.
Formats you can paste as the reference value
Every download page writes hashes in its own way. Box B reads all the formats below, and if a line holds a 64-character hex value it also reads the file name on that line. If you paste several lines, each line is read separately and treated as a list.
| Format | Example | Description |
|---|---|---|
| 64 hex characters | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | The most common notation. Uppercase and lowercase count as the same value. |
| Uppercase in groups of 8 | BA7816BF 8F01CFEA 414140DE 5DAE2223 B00361A3 96177A9C B410FF61 F20015AD | The value split into 8-character words, as in the NIST example document. Spaces, colons and hyphens are ignored. |
| sha256sum list | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad abc.txt | Value, space, mode character (space or *), then the file name. SHA256SUMS files use this format. |
| BSD style (--tag) | SHA256 (abc.txt) = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | The style that sha256sum --tag and shasum --tag print. |
| OpenSSL | SHA256(abc.txt)= ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | The output of openssl dgst -sha256. OpenSSL 3 writes SHA2-256. |
| PowerShell table | SHA256 BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD C:\Users\me\Downloads\abc.txt | A line of Get-FileHash output. The value is uppercase, and only the file name is taken from the path. |
| Base64 | ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= | The 32 bytes written as 44 characters. |
| SRI (integrity) | sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= | The notation of the integrity attribute on script and link tags in web pages. |
If a hex value does not have 64 characters, it is probably another hash. 32 characters is the length of MD5, 40 of SHA-1, 56 of SHA-224, 96 of SHA-384 and 128 of SHA-512. This tool calculates only SHA-256, so for such a value it tells you which algorithm it looks like and shows the command to calculate it on your own computer.
Commands that give the same value on your computer
You can double-check the browser result with a command of your operating system. Replace "filename" in the commands below with the real file name. If the name contains spaces, wrap it in double quotes.
| System | Command | Good to know |
|---|---|---|
| Windows PowerShell | Get-FileHash filename | Without an algorithm it uses SHA256. The value is printed in uppercase. |
| Windows Command Prompt | certutil -hashfile filename SHA256 | Always add the algorithm name SHA256 at the end. |
| macOS | shasum -a 256 filename | Without -a, shasum uses SHA-1, so add -a 256. |
| Linux | sha256sum filename | Prints the value, two spaces, then the file name. |
| Check against a list | sha256sum -c --ignore-missing SHA256SUMS | Prints OK or FAILED for each file in the list. --ignore-missing skips files you did not download. |
Common reasons a text hash does not match
A file hash reads the bytes as they are, so there is little room for confusion, but a text hash often goes wrong because of bytes you cannot see on screen. Nearly every case is one of the five below.
| Cause | Byte difference | How to match it in this tool |
|---|---|---|
| Line break added by echo | One extra 0A | Turn on "One line break at the end". In a terminal, echo -n or printf adds no line break. |
| Windows line breaks | 0D 0A instead of 0A on every line | Change the line breaks to CRLF. A browser input box stores line breaks as LF. |
| UTF-8 BOM | EF BB BF at the very start | Check a file with a BOM in file mode. The list of causes tells you when it finds a BOM difference. |
| Accent composition | 'é' is 2 bytes (NFC) or 3 bytes (NFD) | Set normalization to NFC or NFD. The default keeps the input as typed. |
| Spaces at the start or end | Space 20, tab 09 | Delete them in the input box. This tool never removes spaces by itself. |
When a reference value is present, the tool recalculates with these five and their combinations, starting with the one that changes the least, and checks whether any matches. That is how it can say directly, "If you add one line break at the end, it matches the reference value." Letters in different case are different bytes, so they are not tried.
How to read the visual fingerprint
Reading and comparing 64 characters one by one is easier to get wrong than you would expect. That is why OpenSSH has the VisualHostKey option, which also shows the fingerprint of a server key as a small picture, and the visual fingerprint in this tool uses the same method (the drunken bishop).
- It starts in the middle of a board 17 cells wide and 9 cells high.
- It reads the 32 bytes from the front. From each byte it takes 2 bits at a time, starting with the low bits, four times, and each pair of bits makes one diagonal step. If the first bit is 1 the step goes right, if 0 left, and if the second bit is 1 it goes down, if 0 up. At the edge of the board it stays in place.
- Cells that were visited more often are drawn darker. The circle is the starting point, and the diamond is the end point after 128 steps.
If the two pictures clearly differ at a glance, the values differ. But pictures that look alike do not prove the values are equal. The verdict always comes from the 64-character comparison, and the picture is only an aid for a quick look.
Common mistakes
- Copying the wrong line of the list: SHA256SUMS has several lines, one per version, operating system and CPU. Rather than copying a single line, paste the whole list, and this tool finds the line with the same value or the same name.
- A download that has not finished: if the size is smaller than the download page says, or the name is temporary such as .crdownload or .part, the value is bound to differ.
- A file whose name ends with (1): when you download the same file twice, the browser adds (1) to the name. The name is not part of the hash, so the same content gives the same value. When looking for a name in a list, this tool ignores (1) and letter case.
- A file that was unpacked and packed again: even if the files inside are the same, the compression settings and time stamps differ, so the hash of the archive differs from the original.
- Pasting a file's content into the text box: when you copy the content of a text file and paste it, line breaks, the BOM and the encoding can change. Check the hash of a file in file mode.
- Comparing with the value of another algorithm: if MD5, SHA-1 and SHA-512 are listed on the same page, look at the length first. SHA-256 has 64 characters.
Limits and cautions
- A match means that the two byte sequences are the same. It does not mean that the file is safe or that its author can be trusted.
- If you got the hash and the file from the same server, both may have been changed when that server was compromised. That is why distributions such as Ubuntu attach a GPG signature to the SHA256SUMS file and ask you to verify the signature too. This tool does not verify signatures.
- This tool calculates only SHA-256. For MD5 and SHA-1, collisions that deliberately produce the same hash have actually been built (for SHA-1, Google and CWI published one in 2017), and NIST announced that SHA-1 will be phased out by the end of 2030. To detect tampering, use SHA-256 or stronger.
- Calculation runs at tens to hundreds of MB per second depending on the speed of the device. A file of several GB takes time, and closing the tab during the calculation stops it. On a phone, a file that exists only in the cloud can be read only after the device has finished downloading it.
- Text mode creates bytes only in UTF-8. Check text saved in another encoding, such as Shift_JIS or Windows-1252, in file mode.
- The visual fingerprint is only a visual aid and is not used for the verdict.
Sources
Checked on The NIST FIPS 180-4 standard and example document, the GNU coreutils, Microsoft and OpenSSH manuals and source, and the Ubuntu guide were checked against the originals on October 22, 2026. The values in the examples table gave the same result in this tool, Node.js crypto and macOS sha256sum, and the visual fingerprint was compared with the picture ssh-keygen draws from the same 32 bytes.
- 01NIST: FIPS 180-4 Secure Hash Standard (SHS)Definition of SHA-256, published August 2015
- 02NIST: SHA-256 example computation (SHA256.pdf)Intermediate values and results for abc and the 448-bit message, written as uppercase 8-character words
- 03sha256sum(1), GNU coreutils manualOutput line format, --tag, -c, --ignore-missing
- 04Microsoft Learn: Get-FileHashDefault algorithm SHA256, example output in uppercase
- 05Microsoft Learn: certutil-hashfile InFile [HashAlgorithm], list of supported algorithms
- 06Ubuntu: How to verify your Ubuntu downloadsha256sum -c SHA256SUMS and checking the SHA256SUMS.gpg signature
- 07OpenSSH source: sshkey.c fingerprint_randomart17 × 9 board, four steps of 2 bits per byte, start S and end E
- 08OpenBSD manual: ssh_config(5) VisualHostKeyThe option that also shows a key fingerprint as a picture
- 09NIST: NIST Retires SHA-1 Cryptographic AlgorithmAnnounced December 15, 2022, to be phased out by December 31, 2030
- 10Google Security Blog: Announcing the first SHA1 collisionFebruary 2017, Google and CWI Amsterdam published a real collision
- 11W3C: Subresource IntegrityBase64 notation after sha256- and sha384- in the integrity attribute
- 12Unicode: UAX #15 Unicode Normalization FormsNFC and NFD normalization
Frequently asked questions
Is my file uploaded to a server when I choose it?
No. The file is read in 4 MiB pieces and calculated inside this browser. Neither the file content nor the calculated value is sent to a server. When the calculation ends, only the value on the screen remains.
Can I check an ISO file of several GB?
Yes. The whole file is never loaded into memory at once, because it is read in pieces, so there is no size limit. Calculation runs at tens to hundreds of MB per second depending on the device, so a large file takes time, and the tool shows progress and the time left meanwhile.
If the values match, is the file safe?
A match means your file has the same bytes as the file the reference value belongs to. Whether the reference value comes from the official source, and whether the file itself is safe, needs a separate check. If the publisher signs the checksum list, it is better to verify the signature too.
Can I compare with a value written in uppercase?
Yes. Uppercase and lowercase hex count as the same value. A value split into groups of 8 or separated by colons is also read as 64 characters once the separators are removed.
Why does a hash made in the terminal differ from the text hash?
echo adds one line break byte at the end, so echo hello and hello in this tool give different values. When you paste a reference value, the tool tries the final line break, Windows line breaks and Unicode composition differences and tells you which one matches.
Can I paste a whole SHA256SUMS list?
Yes. When you paste several lines, the value and file name of each line are read, and the tool looks for a line with the same value as your file. If no line has the same value, it compares with the line of the same name and shows which line it differs from. You can also drop a list file or load it with "Open a list file".
What are values with 40 or 128 characters?
40 hex characters is the length of a SHA-1 value and 128 is that of SHA-512. This tool only calculates SHA-256, so for such a value it tells you which algorithm it looks like and shows the command to calculate it on Windows, macOS and Linux.
How do I check that two files are the same?
Switch box B to "Other file" and put in each of the two files, and the two SHA-256 values are compared. If they differ, the tool also shows the difference in size and the position of the first differing byte.