What a checksum is
A SHA-256 checksum is a 64-character fingerprint calculated from every byte of a file. Even a one-byte change produces a completely different fingerprint. Software publishers, Linux distributions, banks and archives publish checksums so you can confirm that a downloaded file is complete and has not been changed.
How it works
Add one or more files of any type. Your browser reads each file and calculates its SHA-256 checksum using the built-in Web Crypto feature; nothing is uploaded. The values appear on screen and are saved in a text file in the standard “checksum filename” format, which command-line tools such as sha256sum can check.
How to compare
Copy the checksum published by the software website and compare it with the one shown — all 64 characters must match. If they match, your file is byte-for-byte identical to the published one. If they do not, download the file again from the official source.
What a checksum does not do
A matching checksum provides strong evidence that the file is the same as the published file; it does not show the file is safe, and it is not a virus scan or encryption. If the website itself was compromised, both the file and its checksum could be fake — download from official sources.
Good habits
Verify large downloads such as operating system images, keep the checksum file with archived backups, and note that this tool needs the website to be opened over HTTPS.