SHA-256 File Verification: How to Check If a File Has Been Tampered With

August 11, 2026 · 6 min read

SHA-256 file verification is the most reliable way to confirm a file hasn't been altered. If even a single byte changes, the hash changes completely — making tampering immediately detectable.

What is SHA-256?

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic function that takes any input — a file, a text string, an entire database — and produces a fixed-length 64-character hexadecimal output called a hash or digest.

Example: the SHA-256 hash of "hello" is:

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Change "hello" to "Hello" and the hash becomes completely different:

185f8db32921bd46d35a7b3965c4c3d295da5c1b4f96bafc33d3f03a6ab3c5d2

This property — called avalanche effect — is what makes SHA-256 useful for file verification.

How SHA-256 file verification works

The process is straightforward:

1. Hash the original file. You compute the SHA-256 hash of a file at the moment you want to establish its integrity.
2. Store or share the hash. The hash is recorded separately from the file itself.
3. Hash the file again later. When you want to verify the file, you compute its SHA-256 hash again.
4. Compare the two hashes. If they match, the file is identical to the original. If they differ, the file has been modified.

Because SHA-256 is deterministic — the same input always produces the same output — this comparison is mathematically reliable.

How to verify a SHA-256 hash online

DocProof includes a free SHA-256 verification tool that works entirely in your browser. Your file is never uploaded — the hash is computed locally on your device.

1. Go to docproof.app/verify-sha256
2. Drop your file into the tool
3. The SHA-256 hash is computed instantly in your browser
4. Compare it to the expected hash — if they match, the file is intact

How to verify SHA-256 from the command line

If you prefer to work in a terminal:

Windows (PowerShell):

Get-FileHash .\yourfile.pdf -Algorithm SHA256

macOS / Linux:

shasum -a 256 yourfile.pdf

The output is a 64-character hex string. Compare it character by character with the expected hash. Any difference means the file has changed.

Common use cases for SHA-256 verification

• Software downloads. Reputable software publishers provide SHA-256 hashes alongside downloads. Verifying the hash confirms the installer hasn't been tampered with or corrupted.
• Document integrity. Confirm a contract or report you received is identical to the one that was sent.
• Backup verification. Confirm that backed-up files are bit-for-bit identical to the originals.
• Legal evidence. Establish that a document presented in a dispute is unaltered since a specific date.
• File transfer verification. Confirm large files transferred over a network arrived without corruption.

SHA-256 vs MD5 vs SHA-1

You may encounter older hash algorithms like MD5 or SHA-1. Both are considered cryptographically broken — researchers have demonstrated the ability to create two different files with the same MD5 or SHA-1 hash, which defeats the purpose of verification.

SHA-256 has no known collisions and is the current standard for file integrity verification. Always prefer SHA-256 when security matters.

Using SHA-256 to prove a file hasn't changed over time

File verification answers "has this file changed?" But it doesn't answer "when did this file exist?" For that, you need a timestamped proof — a record that ties the SHA-256 hash to a specific moment in time.

DocProof does exactly this: it computes the SHA-256 hash of your file locally, records it with a UTC timestamp, and issues a proof ID. Anyone with the original file can verify both the integrity and the date — permanently, without relying on your word.