How do I check a SHA-256 hash on Windows?

Use certutil -hashfile filename SHA256 at a command prompt, or Get-FileHash filename -Algorithm SHA256 in PowerShell. Both produce the same 64-character value that shasum -a 256 gives on macOS and Linux, since they are computing the same function over the same bytes.

Why does my hash not match the certificate?

Almost always because the file changed. Re-saving a document, exporting it again, rebuilding a zip archive, or a transfer that converted line endings all produce different bytes while looking identical. Archive the exact file you certified and work on a copy.

Is hashing in a browser as reliable as the command line?

Yes, when it uses the Web Crypto API, which is the same standard implementation the platform provides. Our tool produces byte-identical output to shasum -a 256, and it works with your connection off — which is a convenient way to confirm nothing is being uploaded.

How to Verify a Hash Yourself

Verifying a hash is a thirty-second operation with tools already on your computer. It is also the step that turns "they told me it matches" into "I checked".

The commands

macOS and Linux

shasum -a 256 filename

or, on most Linux distributions:

sha256sum filename

Windows

certutil -hashfile filename SHA256

PowerShell

Get-FileHash filename -Algorithm SHA256

In a browser — the free SHA-256 hash generator on this site. It uses the Web Crypto API, runs entirely on your machine, and works with your connection turned off. That last property is the point: you can confirm nothing is being uploaded by unplugging.

All of these produce the same 64-character hexadecimal string for the same bytes. If two tools disagree, one of them is hashing something different.

Comparing without going cross-eyed

A 64-character string is easy to skim and get wrong. Some safer habits:

Compare the first six and last six characters for a quick check, then paste both into a text editor for a full comparison when it matters.

Let the machine do it. On macOS or Linux:

[ "$(shasum -a 256 file.pdf | cut -d' ' -f1)" = "expected_hash_here" ] && echo MATCH || echo DIFFERENT

Watch the case. Hex output is case-insensitive in meaning but tools differ in what they print. Lowercase both before comparing.

When the hash does not match

A mismatch means the bytes are different. That is all it means, and the usual causes are mundane.

The file was re-saved. Opening a document and saving it again rewrites it — often with a new modification date embedded inside, or a different compression pass. The content looks identical and the bytes are not.

It was exported rather than copied. A PDF exported twice from the same source is usually two different files.

Transfer altered it. Some tools helpfully "fix" line endings on text files, converting between LF and CRLF. That changes every line.

You hashed the wrong thing. Hashing a folder, an alias, or a zip you rebuilt rather than the original archive. Rebuilding a zip almost never reproduces the original bytes, because timestamps and ordering are stored inside.

Something is genuinely wrong. Rare, but the reason the check exists.

The lesson in all of these: archive the exact file you certified and work on a copy. A timestamp covers bytes, not meaning.

Why "verify it yourself" is not a slogan

There is a specific reason to insist on this rather than accept a green tick on a website.

A verification page you did not write, running on a server you do not control, showing a result you cannot reproduce, is an assertion. It happens to be a true one in most cases, and it is still an assertion. When the record matters — a dispute, an audit, a claim — you want a check that does not route through the party with an interest in the answer.

That is also the standard we hold ourselves to. Our verification page explains each check with a "how to do this yourself" note beside it, because a verification tool that cannot be replaced by three shell commands is doing something it should not need to do.

What a matching hash proves

That two files are byte-identical. Nothing more, and it is a great deal.

It does not tell you where either file came from, who made it, or when — those come from the surrounding evidence. In a timestamp certificate the hash is the link between your file and a dated public record; on its own, it is a fingerprint with no date attached.

For what a hash is and why it works, see what is a SHA-256 hash.