How to Verify a Download with SHA-256 on Windows

A download can finish without an obvious error and still be the wrong file. You may have selected an older version, downloaded a web page instead of an archive, or received an incomplete copy. A SHA-256 comparison answers one precise question: do the bytes you downloaded match the file for which the publisher supplied this hash?

This guide uses a ZIP download as an example. The same steps work for an installer or another ordinary file. You do not need to run the program to calculate its hash.

Start with the correct reference

Use the official product page and release, rather than a hash supplied by an unrelated download site. The ALMARFELD Software catalog links each application to its official GitHub release and verification instructions. Release assets may include a checksum file, and the product page displays the expected value.

Match three things before comparing: application, version and exact asset filename. An installer and a portable ZIP for the same release have different bytes and therefore different hashes. A checksum for an old release is not a reference for a new one. Keep the browser on the release page while you work.

The reference must also come from a source you trust. If someone replaces both a download and the hash beside it, the two can still match. Integrity checking does not establish the publisher’s identity by itself.

Check the file in PowerShell

1. Finish downloading the file. Do not check a temporary browser download while it is still being written.
2. In File Explorer, open the folder containing the download. Open PowerShell there, or enter the complete path in the command below.
3. Run Get-FileHash with the SHA-256 algorithm and the exact filename.
4. Compare the resulting Hash value with the published value for that same asset.

For example, for the App Cleanup Doctor v1.0.0 ZIP:

Get-FileHash -LiteralPath '.\AppCleanupDoctor-v1.0.0-win-x64.zip' -Algorithm SHA256

-LiteralPath treats the supplied path as a filename rather than a wildcard expression. Quotes are useful when a path contains spaces. This command reads the file; it does not extract, install or execute it. Microsoft’s Get-FileHash reference documents the command and its parameters.

The expected hash is shown on the App Cleanup Doctor product page. Use the value there for this particular release. For another product, substitute both its actual filename and its published hash.

Compare the whole value

A SHA-256 value normally appears as 64 hexadecimal characters. Uppercase and lowercase letters mean the same thing. Compare all characters, not just the beginning and end. Avoid copying a filename, an algorithm label or a trailing space as part of the expected value.

If you prefer an explicit comparison, paste the published value into the prompt in this example:

$expected = (Read-Host 'Paste the published SHA-256').Trim()
if ($expected -notmatch '^[0-9a-fA-F]{64}$') {
    throw 'Expected a 64-character SHA-256 value.'
}
$actual = (Get-FileHash -LiteralPath '.\AppCleanupDoctor-v1.0.0-win-x64.zip' -Algorithm SHA256).Hash
$actual -eq $expected

True means those two values match. False means they do not. This is a comparison, not a decision that an application is safe to run.

Use certutil as an alternative

Windows also provides certutil. From a command prompt, an equivalent one-off check is:

certutil -hashfile "AppCleanupDoctor-v1.0.0-win-x64.zip" SHA256

Compare the hash line, excluding the command’s introductory and success messages. Microsoft’s certutil documentation describes -hashfile. PowerShell is usually the clearer choice for repeatable comparisons; certutil is an alternative when you need a quick manual check.

Understand what a match does not prove

ALMARFELD publishes hashes so you can compare downloaded artifacts with its releases. A match is not a malware scan, a security audit or an Authenticode signature. Windows executable signing is a separate mechanism. A signed Git tag concerns the source release reference; it does not turn an unsigned Windows executable into a signed binary.

Current ALMARFELD Windows binaries are not Authenticode signed. Windows may display a reputation or security warning even when the published hash matches. Do not disable Windows security to avoid a warning. Verify the source of the download and decide whether you trust the software and its stated behavior.

Troubleshoot a mismatch

• Wrong file: check whether you hashed the ZIP, the extracted EXE or the checksum text file. These are three different files.
• Wrong algorithm: select SHA256 explicitly instead of comparing an MD5 or SHA-1 value.
• Different version: match the full versioned filename, including architecture and package type.
• Unexpected download: a suspiciously small file may be an error page saved with a ZIP extension. Return to the official release.
• Still different: stop. Download again from the official asset link and check once more. If the result still differs, report the filename, release URL and calculated hash through Support. Do not run the mismatching artifact.

Only after a match should you move on to the product’s extraction and first-run instructions. Keep the downloaded archive if you want to repeat the comparison later.