Why SHA-256 hashes differ and how to verify a file

Two SHA-256 calculations on the same bytes always produce the same hash. If the values really differ, first check the selected file, the algorithm and any invisible characters. An incomplete download, a space or a line break is generally enough to change the result. Before using a downloaded file, compare its complete hash with the one published by a trusted source.

Choose between a file and text

To check a downloaded PDF, archive or program, use the File Hash Calculator. It calculates SHA-256 from the bytes of the selected file. Do not copy the file’s contents into a text field: doing so may change its encoding or line endings.

To compare a string of characters, choose the SHA-256 Hash Generator. It encodes the entered text as UTF-8, then calculates its hash, including spaces and line breaks. A text file and the text displayed on screen therefore do not necessarily represent the same bytes.

Verify a download step by step

1. Find the hash on the publisher’s official website, for the correct version and file. A ZIP archive and the document inside it have different hashes.
2. Check that the reference uses SHA-256. A hexadecimal SHA-256 value has 64 characters. The standard defines a 256-bit output. NIST reference.
3. In the file calculator, click “Choose a file”. Check the displayed filename and size, then click “Calculate SHA-256”.
4. Use “Copy hash” and compare all 64 characters with the reference. The button copies only the hash; you still need to compare it. Hexadecimal letters A–F and a–f represent the same values.
5. If they differ, do not run the file. Check the expected version, then download it again from the official source. If the mismatch persists, ask the publisher for confirmation.

An example with just one line break

In the text generator, enter exactly abc, without quotation marks, spaces or a line break. Click “Calculate hash”. The three UTF-8 bytes are 61 62 63 in hexadecimal. The result is:

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Next, place the cursor after the c, press Enter once and calculate again. With this LF line break, the input has four bytes: 61 62 63 0a. The result becomes:

edeaaff3f1774ad2888673770c6d64097e391bc362d7d6fb34982ddf0efd18cb

To reproduce these results with files, save the first as UTF-8 without a BOM or a final line break, and the second with just one final LF. The calculator should show 3 and 4 bytes respectively. Some editors automatically add a line break: check that setting.

Differences you cannot see

A space after a word, a tab or an empty line is part of the content. LF and CRLF line endings use different bytes. A UTF-8 file with a BOM also has additional bytes at the beginning compared with the same text saved without a BOM.

Accented characters can also be surprising: an é and an e followed by a combining accent may look alike on screen while having different representations. The generator does not normalize them automatically. The Text encoding inspector and UTF-8 converter helps you examine the BOM and line endings of text files up to 5 MiB. You must confirm the suggested encoding; without a BOM, it cannot always be identified. Do not convert the file before checking its original hash.

What the check tells you

A matching SHA-256 hash provides a strong integrity check, without being a mathematical guarantee of uniqueness: hash functions are designed to make collisions difficult to find. RFC 6234.

It does not prove that the file is harmless or that its author is who they claim to be. If an attacker supplies both a modified file and its hash, the two will match. The source of the reference remains essential. A digital signature verified with a trusted key provides a separate authenticity check.

Checklist before drawing a conclusion

• Same file, same version and same algorithm
• Reference obtained from a trusted source
• Complete hash compared, allowing for uppercase and lowercase hexadecimal letters
• No modification, conversion or re-export between calculations

Frequently asked questions

Does renaming a file change its hash?

No: its name is not part of the calculation. However, changing metadata stored inside the file changes its bytes and generally its hash.

Can I recover a file from its SHA-256 hash?

SHA-256 is not encryption and has no decryption key. A hash is used to compare data, not to restore it or to hide a predictable secret.

Why does a large file fail?

The calculation stays in the browser, but the entire file is loaded into memory. The API used does not stream its input, so the practical limit depends on the device and browser. The page and its resources are still loaded from the website. MDN documentation.