A checksum fingerprints exact bytes
SHA-256, SHA-384, and SHA-512 produce deterministic digests. A one-byte change produces a different result, making checksums useful for transfer integrity and duplicate confirmation.
Verify a software download or ISO
Obtain the expected checksum from the vendor's authenticated website, choose File mode and the same SHA algorithm, select the downloaded file, paste the expected digest, and calculate. Case and harmless whitespace are normalized; every hexadecimal digit must otherwise match.
What a checksum does not prove
A match proves equality with the bytes represented by the expected value. If an attacker can replace both the download and checksum, the match does not authenticate the publisher. A verified digital signature can provide origin evidence that an ordinary digest cannot.
Why this tool uses current SHA-2 algorithms
OpenFileTools supports SHA-256, SHA-384, and SHA-512. It does not add MD5 or SHA-1 because collision weaknesses make them poor defaults for new verification workflows.
Privacy, memory, and troubleshooting
Web Crypto digest requires one complete input buffer, so the file limit is 200 MB and the UI does not claim streaming. A mismatch can mean the wrong algorithm, a changed download, a copied checksum error, or a different release.
- Files are not uploaded.
- Re-download from the authoritative source after an unexplained mismatch.
- Checksum comparison is not decryption.