安装包、系统镜像、开源软件的下载页都写着一行 SHA-256——它是防止文件被篡改或下载不完整的指纹锁。本文讲清原理、三平台命令行方法与排查顺序。附免费在线校验工具（纯本地计算）。
校验和是什么
SHA-256 是一种密码学散列函数：对任意大小的输入（一个文件、一段文本）计算出一个固定 64 个十六进制字符的「指纹」：
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
它有三个关键性质：
- 确定性：同样的输入永远得到同样的输出——所以能当指纹
- 雪崩效应：改动文件里 1 个字节，指纹面目全非——所以能发现篡改
- 不可逆与抗碰撞：无法从指纹反推文件，也几乎找不到两个文件同指纹——所以难以伪造
为什么下载要验哈希
- 下载不完整：大文件传输中断，残缺文件装不上或行为诡异——哈希一验便知
- 传输被篡改：镜像站、内网代理、被入侵的 CDN 都可能递给你修改过的文件
- 供应链攻击：软件更新通道被劫持时，官方公布的哈希是最后一道比对标准
做法很简单：发布方公布 文件 + SHA-256 值，你本地对下载的文件算一遍，两边一致才安装。
三平台命令行方法
| 平台 | 命令 |
|---|
| Windows (PowerShell) | Get-FileHash 文件名 -Algorithm SHA256 |
| Windows (CMD) | certutil -hashfile 文件名 SHA256 |
| macOS / Linux | shasum -a 256 文件名 或 sha256sum 文件名 |
注意：Windows 的 Get-FileHash 支持 SHA1 / SHA256 / SHA384 / SHA512 / MD5；certutil 的算法名大小写敏感度随版本不同，写 SHA256 最稳。
不想敲命令：本地在线工具
命令行之外的图形化选择：用纯浏览器本地处理的在线校验工具（如 本站 SHA 校验和工具），把文件拖进去就出哈希，再贴上期望值自动比对——文件不上传，与命令行同等安全，对大文件（几 GB 镜像）也适用。
校验失败排查顺序
- 算法一致吗：把 SHA-1 的值粘到 SHA-256 框必然不匹配，先核对发布方公布的算法名。
- 复制的值干净吗：网页复制常混入空格、换行、大小写差异——本站工具比对时自动忽略，别的工具未必。
- 文件完整吗：对比文件大小与发布页标注是否一致；浏览器下载中断常产生截断文件。
- 换源重下：以上都排除仍不匹配，说明文件本身有问题——不要安装运行，换官方主源重新下载。
常见问题
Q：哈希和校验和是一回事吗？
A：校验和是泛指，哈希特指 SHA-256 这类密码学散列。日常语境基本同义，但哈希的抗碰撞性远强于旧式求和校验。
Q：SHA-1 和 SHA-256 该用哪个？
A：一律优先 SHA-256；SHA-1 已被实际攻破，只用于兼容旧清单。关键是与发布方公布的算法一致。
Q：Windows 上怎么算 SHA-256？
A：PowerShell 用 Get-FileHash 文件名 -Algorithm SHA256，CMD 用 certutil -hashfile 文件名 SHA256；或用本地在线工具拖文件。
Q：校验和匹配就绝对安全吗？
A：只证明文件与发布方算哈希时的字节一致。官网本身被入侵时哈希也会被替换——重要软件用 GPG 签名做更强验证。
Q：为什么不同工具算出的哈希不一样？
A：最常见是算法不一致，其次是文本被编码转换（CRLF/LF、BOM）后再计算。校验文件永远用文件本体计算。
免费在线 SHA 校验和工具
SHA-256/384/512/1 · 文件与文本 · 期望值一键比对 · Web Crypto 纯本地计算
打开校验和工具 →
What a checksum is
SHA-256 is a cryptographic hash function: it maps any input (a file, a text) to a fixed 64-hex-character "fingerprint":
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Three key properties:
- Deterministic: same input always yields the same output — hence a fingerprint
- Avalanche effect: flipping 1 byte changes the fingerprint completely — hence tamper detection
- Irreversible & collision-resistant: can't reverse the fingerprint, and finding two files with one fingerprint is practically impossible — hence hard to forge
Why verify downloads
- Incomplete downloads: big-file transfers break; a truncated installer fails oddly — a hash check reveals it instantly
- Tampering in transit: mirrors, internal proxies, or compromised CDNs can hand you modified files
- Supply-chain attacks: when update channels get hijacked, the officially published hash is the final line of comparison
The workflow is simple: the publisher announces file + SHA-256; you hash your downloaded file locally and install only when the two match.
Command line on three platforms
| Platform | Command |
|---|
| Windows (PowerShell) | Get-FileHash filename -Algorithm SHA256 |
| Windows (CMD) | certutil -hashfile filename SHA256 |
| macOS / Linux | shasum -a 256 filename or sha256sum filename |
Note: Get-FileHash supports SHA1/SHA256/SHA384/SHA512/MD5; certutil algorithm-name casing varies by version — SHA256 is the safe spelling.
No terminal? Local online tools
For a graphical option, use a browser-local checker (like our SHA Checksum tool): drop the file in for an instant digest, paste the expected value for auto-comparison — files are never uploaded, as safe as the command line, and it handles multi-GB images.
Troubleshooting failed checks
- Same algorithm? A SHA-1 value never matches a SHA-256 field — check the published algorithm name first.
- Clean copy? Web copies often carry spaces, line breaks, and case differences — our tool ignores them; others may not.
- File complete? Compare file size with the download page; interrupted browser downloads often truncate.
- Re-download from the official source: if all else is ruled out, the file itself is bad — don't install or run it.
FAQ
Q: Are hash and checksum the same thing?
A: "Checksum" is the umbrella term; "hash" specifically means cryptographic digests like SHA-256. In daily use they're interchangeable, but hashes are far stronger than legacy summation checks.
Q: SHA-1 or SHA-256?
A: Prefer SHA-256; SHA-1 is broken and only for legacy manifests. Always match the publisher's published algorithm.
Q: How do I compute SHA-256 on Windows?
A: PowerShell: Get-FileHash filename -Algorithm SHA256; CMD: certutil -hashfile filename SHA256; or drop the file into a local browser tool.
Q: Does a matching checksum mean the file is absolutely safe?
A: It proves your bytes match what the publisher hashed. If the official site itself is breached, the hash is replaced too — use GPG signatures for stronger assurance.
Q: Why do different tools give different hashes?
A: Usually algorithm mismatch; for text, encoding conversion (CRLF/LF, BOM) before hashing. Always hash the file itself.
Free Online SHA Checksum Tool
SHA-256/384/512/1 · Files & text · One-click compare · Web Crypto, fully local
Open Checksum Tool →