Encoding and security guides
Verify a download with SHA-256: hash the file bytes
Calculate a file digest, compare it with a trusted release value, and distinguish integrity from publisher authentication.
Obtain the expected digest
Use the checksum provided through a trustworthy release channel. A digest copied from the same compromised download location may be compromised too.
Confirm the algorithm and exact artifact name. A checksum for a source archive cannot verify a separately built binary release.
Hash the downloaded file
Use File Hash to hash the original bytes, including any compressed archive container. Do not extract it unless the published checksum describes the extracted file.
For command-line comparison, standard SHA-256 tools compute the same digest for the same bytes, independent of the file’s displayed name.
Linux: sha256sum archive.zip
macOS: shasum -a 256 archive.zipInvestigate mismatches
A mismatch can indicate truncation, a different version, line-ending conversion or malicious alteration. It does not identify the cause by itself.
Check file size and the release filename, then retrieve the intended artifact again. Do not accept the mismatch merely because the archive opens successfully.
Keep browser limits in mind
Nav Tools processes files locally within its documented file-size limit. Large release images need a native or streaming file-hash tool.
A matching digest supports integrity relative to the expected value. Publisher authentication may additionally require a verified digital signature or trusted distribution channel.