What is a file hash?

A file hash (or digest) is a fixed-size fingerprint of a file’s exact contents. SHA-256 always produces 256 bits — 64 hex characters — whatever the input: a 10 KB text file and a 40 GB disk image both come out as exactly 64 characters. Three properties make it useful:

• Deterministic. The same bytes always give the same digest, on any machine, in any language. That is what makes hash comparison a reliable integrity check.
• One-way. You cannot work backwards from a digest to the file. A hash identifies and verifies without revealing the contents.
• Avalanche. Change one byte of a 1 GB file and roughly half the output bits flip, unpredictably. There is no “close” hash for a “close” file — so a tampered file will not match the original’s digest.

The practical upshot: if you can prove you have the same bytes the vendor had, you have the same file. That is the whole foundation of download verification, and it is why hashes are the first thing to check when a file behaves suspiciously.

Why check a hash?

Malware hash lookup

Security databases are built around hashes, not filenames: a malware sample is identified by its digest because names can be changed in a second while the bytes cannot. When an antivirus flags a file — or when you download something from an untrusted source — looking up the hash tells you whether that exact file has been seen before, and in what context. A hash that appears in many unrelated download locations is a strong signal of a widely distributed file; a hash tied to one suspicious URL is a red flag worth investigating.

File integrity

Hashes catch silent corruption. Disk errors, interrupted downloads and faulty network links can flip bits without any visible damage to the file — a corrupted ISO, installer or backup that still “looks” fine. Comparing the hash of what you have against the hash of what you expected is the only way to be sure the bytes survived the journey intact.

Verifying downloads

Reputable vendors publish the SHA-256 of every release next to the download. Hash the file you got, compare it with the published value, and you have cryptographic proof the download arrived unmodified — ideally checking the published hash over a different connection or device than the file itself, so a compromised mirror cannot fake both.

How do hash databases work?

A hash database is a lookup table: digest → what we know about that exact file. Entries are built from monitored downloads, vendor feeds and community submissions. Each record typically stores the file’s digests (MD5, SHA-1, SHA-256, SHA-512), its size, the product it belongs to, and the download location(s) where it was observed, with the dates it was seen.

The hash-check.com database this tool queries works that way: a lookup answers “have we seen this exact file before, and if so where?”. Two things worth keeping in mind:

• A match is provenance, not a verdict. It tells you the file exists in the database and which download locations are associated with it. It does not by itself label the file malicious or clean — it gives you the context to judge it.
• No match is not a safety certificate. It only means the database has no record of this exact file. New, rare or never-submitted files will not be found — absence of evidence is not evidence of safety.

SHA-256 vs the other digests

Algorithm	Output	Status	Typical use
MD5	128 bits (32 hex)	Cryptographically broken — collisions can be manufactured on purpose.	Legacy compatibility only. Never use it where integrity matters.
SHA-1	160 bits (40 hex)	Broken for collision resistance (practical collision demonstrated in 2017, “SHAttered”).	Legacy systems and git commit IDs, where it is not a security boundary.
SHA-256	256 bits (64 hex)	Secure. No practical attacks known. The default in TLS, package managers and download verification.	The safe default: malware hash lookup, checksums, integrity checks.
SHA-512	512 bits (128 hex)	Secure. Often faster than SHA-256 on 64-bit hardware.	Very large files on 64-bit systems; longer-digest requirements.

This tool uses SHA-256 because it is the interoperable standard: every OS, browser and security tool speaks it. If you have a SHA-1 or MD5 instead, the Hash Generator tool can re-derive the full set from the file itself.

Hash a file from the command line

Prefer the shell? These stream the file, so huge files are fine:

# Linux / macOS
sha256sum file.iso

# Windows PowerShell
Get-FileHash file.iso -Algorithm SHA256

Copy the 64-character result into the Paste a hash tab above and you are one click from the lookup. Nothing on this page leaves your browser except the hash itself, sent to hash-check.com for the lookup.