What a SHA-256 hash gives you

A SHA-256 digest is a deterministic, 64-character hexadecimal string derived from any input - a sentence, a file, or a whole drive image. The same input always produces the same digest, and any change to the input, however small, produces a completely different one. That property makes hashes the standard tool for integrity checks: verify the digest matches, and you know the data is untouched.

Use the hash for verification, not reversal

Hashes are one-way. You cannot recover the original file from its hash, and 'decrypting' a hash is not a real operation; the only way to find a matching input is to try candidates. Treat a hash as a fingerprint to compare, never as a secret you can unwrap.

How to generate one consistently

When you download a file that publishes a checksum, compute the hash of the copy you received and compare the two strings. Beware three classics:

  • Line endings: a text file copied between Windows and Unix can differ in bytes even when it looks identical, so the hashes will not match.
  • Extra bytes: a newline added at the end of the file changes the digest. Hash the file exactly as distributed.
  • Case: hex digests are conventionally lowercase, but uppercase is the same value. Compare case-insensitively.

Where hashes appear in daily work

  • Download pages publishing .sha256 checksums.
  • Software releases verifying that an installer was not tampered with in transit.
  • API webhooks passing a payload hash so both sides can detect modifications.
  • Deduping and cache keys, where identical content reuses a stored digest.

What a hash does not prove

A matching hash proves the bytes you have match the bytes whoever computed the hash had. It does not prove the file is safe or authentic - a malicious actor can publish their own checksum for their own build. For genuine supply-chain trust you also need a signature or other verification against a trusted source.

Practice it now

Take any sentence, generate its SHA-256 digest, then change one character and regenerate. The outputs should be completely unrelated. That dramatic avalanche effect is the whole point: integrity checks are only meaningful because the tiniest alteration is instantly visible in the digest.