Check a download’s SHA-256 hash on Windows
Calculate a file hash with PowerShell or the local browser tool, compare it with the publisher’s value and understand what a match can prove.
In brief
A matching SHA-256 value means the file you checked matches the file represented by that hash. It is useful for detecting an incomplete or changed download, provided the comparison value came from a trusted publisher page.
A hash copied from the same untrusted download page can describe a malicious file perfectly. The origin of the expected value matters as much as calculating your own.
Prepared from the linked primary documentation. Examples explain a procedure or calculation; they are not a device benchmark or a hands-on product review.
Choose the correct comparison value
Find the exact release, operating system and architecture you downloaded. A Windows installer and a portable archive can legitimately have different hashes. Do not compare one with the other merely because their product names match.
Use the publisher’s site, not a message that tells you to trust its own attached file and hash. For a signed installer, a signature is a separate check; it is not replaced by this calculation.
Calculate without running the file
Open PowerShell in the folder containing your download, or use the file’s full path. The command below reads installer.exe from the current folder; change that name to your actual file. It does not install or execute it.
Copy the value under Hash and compare all characters with the publisher’s SHA-256 value. Uppercase versus lowercase does not matter. A SHA-1 or MD5 value has a different algorithm and cannot be compared to a SHA-256 result.
Get-FileHash -LiteralPath '.\installer.exe' -Algorithm SHA256Handle a mismatch and the limits
Check whether you selected the wrong release, a differently packaged edition or a download that has not finished. Download again from the official source if needed, then calculate again. Do not edit the file or delete characters from the expected hash to create a match.
You can also use LA24X’s file-hash tool for local calculation in the browser. It does not upload the file or check its reputation. For a large file, the PowerShell option can be more convenient than holding the browser tab open.
A complete comparison you can recognize
A SHA-256 value is 64 hexadecimal characters: digits 0–9 and letters A–F. Compare the entire string for the exact file, not just its first and last few characters. A different edition or architecture is a different file even if its download button uses a similar name.
As a known calculation example, the three bytes abc without a newline produce the hash below. This value is only for that tiny example, never an expected hash for a real installer. The browser file-hash tool and a standard SHA-256 implementation should agree on the same bytes.
Illustrative example
A file containing abc followed by a line break has different bytes and therefore a different hash. A mismatch in this demonstration can be caused by encoding or line endings; do not apply that explanation to dismiss an unexplained mismatch in a software download.
abc (UTF-8, no newline)
SHA-256: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adDocumentation for these steps: Microsoft — Get-FileHash ↗
Before you act
A hash match is not a malware scan, software signature or guarantee of suitability. Check the publisher, product and operating-system version as well.
What to do next
- Get the expected SHA-256 value from the publisher’s official download or release page.
- In PowerShell, run Get-FileHash with the actual downloaded file path and -Algorithm SHA256.
- Compare the full 64-character result, ignoring letter case but not missing characters.
- If it differs, recheck the edition and file name; do not run the installer until the mismatch is explained.
