A SHA-256 file hash is a fixed-length digest calculated from every byte of a file using the SHA-256 algorithm. It is usually displayed as 64 hexadecimal characters. A tiny file change produces a different digest, making hashes useful for checking whether a download matches a known release. The comparison only establishes a match to the reference supplied; it does not establish that either file is safe. The expected digest therefore needs an independently trustworthy origin. A file hash differs from a password, an application signing certificate and a URL, even when all are presented near a download link.
SHA-256 file hash and Malware scan
A digest compares bytes; it is not a malware analysis or security certification.
Compare the exact distributed file
Calculate the hash of the complete file that was downloaded and compare the full result with the publisher's expected digest. A renamed file can retain the same bytes and hash, while an extracted or repackaged file will be different. Confirm that the reference describes the same version, architecture and packaging format before treating a mismatch as evidence of tampering.
A match has a limited meaning
A matching digest is strong evidence that the bytes match that reference. It is not a verdict about permissions, malware, licensing or compatibility. If an attacker controls both a download and the page listing its hash, matching them provides little independent assurance. Package signing, publisher identity and the supported distribution route provide different information and should not be collapsed into one safety claim.
Investigate a mismatch without installing
An incomplete transfer, wrong variant, updated release or changed archive can all cause different hashes. Check the release details, then retrieve the file again from the verified source if appropriate. Preserve the filename, size, expected digest and calculated digest for the publisher. Avoid posting full account-bearing download URLs with the report, since the hash itself does not require revealing a secret link.
An illustrative example
A publisher lists one SHA-256 digest for its TV build and another for its phone build. A customer compares the phone reference with a TV download and sees a mismatch. Checking the exact variant prevents a false conclusion. If the correct TV reference still differs, the package should be investigated before installation.
Practical actions
- Compare all digest characters against a trusted reference for the exact release.
- Recheck version, architecture and archive format when hashes differ.
- Keep account-bearing download links private when sharing verification results.