FREE TOOL · GUIDE
Check a file's SHA-256, here or with one command
Drop a file to get its SHA-256. It is calculated in this browser tab: the file is not uploaded, and once the page has loaded it works with the network switched off.
- File
- Size
- SHA-256
Written by Taha Bayar, a biologist working on laboratory data handover. Kionel takes this same value from every file it transfers.
The same check from the command line
| System | Command | Worth knowing |
|---|---|---|
| Windows, Command Prompt | certutil -hashfile "C:\data\run_041.csv" SHA256 | Built in. On Windows 7 the value is printed with spaces between each pair of characters; the spaces are not part of it. |
| Windows, PowerShell | Get-FileHash "C:\data\run_041.csv" | SHA-256 is the default. Needs PowerShell 4.0, so it is missing on an unupdated Windows 7. Prints capital letters. |
| macOS | shasum -a 256 ~/Desktop/run_041.csv | Without -a 256, shasum gives SHA-1: a different, 40-character value. |
| Linux | sha256sum run_041.csv | With a list of expected values, sha256sum -c list.txt checks many files at once. |
| Android, iPhone | none built in | Open this page in the phone's browser and pick the file. |
Five reasons two hashes of "the same" file differ
- Someone opened it and pressed Save. Excel rewrites a CSV when it saves it: number formats, quotes and line endings can change while every value on screen looks the same. Take the hash before anyone opens the file.
- Line endings were converted. Windows ends a line with two characters, Linux and macOS with one. FTP in ASCII mode, some e-mail gateways and Git's
autocrlfsetting convert them without saying so. - A different algorithm was used. SHA-256 is 64 characters, SHA-1 is 40, MD5 is 32. Many "checksum" tools default to one of the shorter ones.
- The copy is incomplete. A transfer that stopped early leaves a shorter file. Compare the sizes first; it is the quickest hint.
- Only the way the value is written differs. Capital or small letters, and the spaces from older certutil, do not change the value. This page ignores both when it compares.
What a matching hash does not tell you
A match proves two files are identical. It does not say who produced the file, when, or whether the value you compared against was itself replaced. An auditor asking "is this the result that left the instrument PC?" needs the hash tied to a signature and a work order at the moment the file left.
That is what Kionel records. When a file leaves an offline PC through Kionel, the sending PC signs its SHA-256 together with the work order; the receiving device recomputes it on arrival and signs a receipt. The verify page checks both records later and recomputes the file's SHA-256 against them.