How to verify a download in three steps
First, obtain the reference digest from a source you trust, preferably alongside a separately verified digital signature. Next, select the downloaded file and the same algorithm as the published digest. Finally, paste the complete expected value: a match means the bytes agree with that reference, not that the publisher is genuine.
SHA-256 versus SHA-512
SHA-256 produces 64 hexadecimal characters; SHA-512 produces 128. An optional label such as SHA-256: must agree with the selected algorithm. Wrong labels and incomplete or malformed digests are rejected rather than silently normalized.
Privacy, file size and browser memory
The WebCrypto API calculates the digest locally. Because this API reads the whole file into memory, this tool limits files to 64 MB. It does not stream larger files and does not generate a modified file for download. For larger files, use a trusted desktop checksum utility.
What matching checksums do not prove
Equal digests provide strong evidence that the local file matches the referenced bytes. A checksum cannot authenticate its publisher, detect malicious content already present in the reference, or replace a digital signature. If you need to inspect a suspicious archive, use archive inspection; if a file fails to open, see file diagnosis.