A Hash Represents the File’s Bytes, Not Its Name
A hashing algorithm reads an input byte sequence and produces a fixed-length digest. For a given algorithm, exactly the same bytes produce exactly the same result. If the file contents change, the digest will usually be very different, even when the change is small. Cryptographic hashes are designed to make it difficult to find distinct inputs with the same digest, although that protection varies by algorithm.
Renaming release.zip to backup.zip does not change a content hash when the underlying file bytes stay identical. Modifying a single byte does. Conversely, two archives may contain the same documents but have different hashes because their compression settings, metadata stored inside the archives, or byte layout differ. A checksum compares the actual input bytes, not an abstract idea of what the file contains.
Verify a Download Against Its Published SHA-256
- Find the official checksum. Look for a SHA-256 value on the software publisher’s download page or in its release checksums file. Prefer an authenticated publisher channel rather than a random repost.
- Select the exact downloaded file. Use the file selection control above. Do not substitute an extracted folder or a different release version.
- Generate the matching algorithm. If the interface offers SHA-256, select it when your reference is SHA-256. An MD5 result cannot be compared with a SHA-256 result.
- Compare the complete digest. Check all hexadecimal characters. Uppercase and lowercase hexadecimal represent the same bytes, but missing characters or a different value indicate a mismatch.
- Investigate mismatches before use. Recheck the file, version, algorithm, and checksum source. If the values still disagree, avoid installing or sharing that copy until the difference is explained.
A checksum comparison may require manual copying if the tool does not provide a dedicated verification field. Do not treat an unverified interface feature as available.
SHA-256, SHA-512, SHA-1, and MD5 Compared
The checksum’s algorithm determines its output length and security properties. The following are common file-hashing formats, not a claim that every one is implemented by the generator above.
Use SHA-256 for a new integrity workflow unless the publisher or protocol specifies another secure option. SHA-1 and MD5 have known collision weaknesses. Their continued presence in older downloads does not make them suitable for modern authenticity or signature protection.
A Small File Example You Can Reproduce
Imagine a file containing only the three ASCII bytes abc, with no newline, spaces, or byte-order mark. Its SHA-256 digest is:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
This is a standard reference value for those exact three bytes. Create such a file and calculate its SHA-256 to check a hashing implementation. If you accidentally create abc followed by a newline, the hash will differ. A text editor can also insert encoding markers or different line endings, so a visually identical file is not necessarily byte-identical.
Hashing an empty file gives another useful reference: its SHA-256 is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. These examples validate known SHA-256 inputs; they are not claims that this WordPress plugin was tested.
Check a File Independently on Windows, macOS, or Linux
For sensitive downloads or troubleshooting, an operating-system command gives you a separate way to calculate the reference digest. Replace the sample filename with the real path on your computer.
Windows PowerShell:
Get-FileHash -Path "./download.zip" -Algorithm SHA256
macOS Terminal:
shasum -a 256 download.zip
Linux terminal:
sha256sum download.zip
All three commands calculate SHA-256 over the chosen file bytes. Different presentation styles, such as uppercase versus lowercase letters or an additional filename, do not change the underlying digest. If the browser and the command line disagree, verify that both read the same file and selected the same algorithm.
Why a Matching Checksum Is Not a Malware Scan
A strong hash makes accidental corruption or unexpected changes detectable when compared with a trustworthy reference. It does not inspect executable behavior, detect viruses, prove a publisher’s identity, or tell you whether the original software was safe. A malicious publisher could publish a malicious file and its matching checksum.
For stronger assurance, obtain the checksum over an authenticated channel and verify a digital signature when the publisher provides one. Keep operating-system security checks and malware protection in place. A matching SHA-256 is useful evidence of byte-for-byte consistency with the reference; it is not a substitute for provenance or security assessment.
Common Reasons Two File Hashes Do Not Match
When using a SHA256SUMS file, each line commonly pairs a digest with a filename. Compare the checksum for the exact filename you downloaded. A valid digest for a different build or platform should not be accepted as a match for your own file.
Large Files, Private Documents, and Processing Limits
Large video files, disk images, and backups can require substantial time or memory to hash, depending on the implementation. In a browser, the Web Crypto digest() API requires its input to be available in memory; streaming implementations use different techniques. The site’s actual algorithm coverage, maximum file size, progress indicators, and whether files are processed locally or uploaded need to be confirmed from its plugin behavior.
Until that verification is complete, avoid selecting confidential records, private backups, keys, or sensitive customer documents. For large or sensitive files, the operating-system commands above can be a more appropriate choice because they operate on local files without requiring a website.
Hashing Is Not Encryption or Password Storage
A cryptographic hash is a one-way digest, while encryption is designed to let an authorized party recover plaintext using a key. A file hash cannot restore the original document. It also provides no secrecy: anyone who has the same file and algorithm can calculate the same digest.
Do not use ordinary file-checksum functions to store user passwords. Password storage requires a dedicated salted, computationally expensive password-hashing method, such as Argon2id, with appropriate configuration and server-side controls. Likewise, a file checksum does not replace a digital signature or a keyed message authentication code.
Questions About Hashing Real Files
Will changing a filename change its SHA-256? No, not when only the filename changes. Standard file hashing reads file contents, not the surrounding directory entry.
Can two different files have the same hash? In principle, yes, because a fixed-length digest has fewer possible outputs than the set of all files. Secure algorithms make deliberate collisions computationally difficult; MD5 and SHA-1 no longer offer reliable collision resistance.
Is a SHA-256 checksum the same as a digital signature? No. A checksum is an unkeyed digest. A digital signature incorporates a private-key operation and can support authenticity verification when checked with a trusted public key.
Can I compare an MD5 value with a SHA-256 value? No. Recalculate the file using the algorithm named in the reference checksum.
Does a matching hash prove that two filenames identify the same download? It strongly supports that the compared byte sequences match, assuming a suitable algorithm and an authentic reference. It does not establish that either filename, source description, or file’s contents are trustworthy.
