What a checksum proves
SHA-256 maps any file to a 64-character fingerprint. Changing a single byte changes the fingerprint completely, and nobody can construct a different file with the same SHA-256. So if the hash of your download equals the hash the developer published, the file is bit-for-bit the official build โ not a version with a modified address, a backdoor or malware bundled in.
A checksum alone proves equality with the published list. To trust the list itself, projects sign it: Bitcoin Core publishes SHA256SUMS with SHA256SUMS.asc signed by several builders; Electrum and Sparrow sign each release with the developer's PGP key; hardware-wallet vendors such as Trezor and Ledger verify firmware signatures on the device itself during installation. Check the signature too when the project offers one, using a key obtained from a source independent of the download page.
How to verify a download
- Download the file from the project's official site (type the address or use a bookmark, not a search ad).
- Open the page with the hashes or download the SHA256SUMS file from the same release.
- Select the file here. The hash is computed in this tab with the browser's Web Crypto API.
- Paste the published hash or the whole list; the tool finds the line for your file name and compares.
- If it does not match, delete the file and download again. A mismatch is never 'close enough'.
For files over 2 GB use the command line: sha256sum file (Linux), shasum -a 256 file (macOS) or certutil -hashfile file SHA256 (Windows).
When checksums matter most
Desktop wallets downloaded as archives or installers, wallet apps sideloaded as APK files, firmware files for hardware wallets that you install manually, and node software such as Bitcoin Core. App-store installs are checked by the store's own signing, but fake apps in stores exist โ confirm the publisher name and the link from the developer's website before installing.
Frequently asked questions
+Is my file uploaded anywhere?
No. The browser reads the file and computes the hash locally with crypto.subtle.digest. Nothing leaves your device.
+The site publishes SHA-512, not SHA-256. Does that work?
Yes. The tool computes both and compares your pasted value with each.
+The hash matches but the site was fake โ am I safe?
No. If you took the hash from the same fake site, it simply describes the fake file. Get the hash from the official source, ideally a signed list.
+Why does my hash differ in upper and lower case?
Hex is case-insensitive; the comparison ignores case and spaces.
+Do I need this for Ledger or Trezor firmware?
Official apps install firmware and the device verifies the vendor's signature. Manual checks matter when you download firmware or the companion app yourself.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.