How to verify a SHA-256 checksum without confusing integrity and authenticity

Short answer

To verify a SHA-256 checksum, hash the exact same bytes and compare the result with an expected value obtained from a trusted source. A match shows that the bytes have not changed relative to that reference. It does not by itself prove who published the file: an attacker who replaces both can provide a new hash.

A reproducible text example

The ASCII text abc, with no trailing line ending, produces:

ba7816bf8f01cfea414140de5dae2223
b00361a396177a9cb410ff61f20015ad

Together the two lines form 64 hexadecimal characters, or 256 bits. You can check the vector in the SHA-256 generator, which hashes UTF-8 text locally in the browser.

A space, capital letter, or line ending produces a different result. If a comparison fails, first verify the actual input bytes: copying text from a terminal or editor can add an invisible newline.

Hash a file as a file

The current web tool processes text, not binary files. To verify a download, use a system utility that reads the file bytes directly, for example:

shasum -a 256 file.zip

On systems with GNU coreutils, the usual command is:

sha256sum file.zip

Compare all 64 characters without modifying the file. Letter case in the hexadecimal display does not change the value, but any different digit does.

Integrity is not authenticity

SHA-256 is specified in NIST FIPS 180-4 and can detect changes when digests are compared. For the check to be useful, the expected hash must arrive through a trusted channel: an official HTTPS page, a verifiable digital signature, or an authenticated manifest.

If the file and checksum come from the same compromised location, the comparison only shows that they agree with each other. It does not identify the author or certify that the contents are safe.

Short procedure

1. Obtain the checksum from the official source and keep all 64 characters.
2. Calculate SHA-256 over the exact file without opening or converting it.
3. Compare the entire digest, not just its beginning or end.
4. If it differs, do not use the file; download it again from a known source and investigate.
5. If publisher identity matters, verify a digital signature as well.

This keeps two questions separate: “are these the same bytes?” and “can I trust who distributed them?”