Use Free OK — A verification checklist for free | usefreeok.com
Compute the hash of your downloaded file and compare it, character by character, with the publisher's 64-character value.
A SHA-256 checksum is exactly 64 hexadecimal characters — a fingerprint of the file's contents. Its useful property is fragility: changing a single byte of the file changes the whole digest, so two files that differ in any way produce visibly different checksums.
Find the publisher's value first. It normally lives on the download page, near the link, often labelled SHA-256 or SHA256. If the publisher publishes no checksum at all, this check is simply impossible for that file — note it and lean on the signature and sandbox steps instead.
Compute the hash locally. On Windows, the built-in command certutil -hashfile filename SHA256 prints the digest; on macOS, shasum -a 256 filename does the same. Both work on any file the system can read, with nothing to install.
On narrow screens, swipe or scroll the plate sideways.
Compare all 64 characters against the published value. Letter case does not matter; every character does. An exact match means your copy is bit-for-bit identical to what the publisher released.
A mismatch has three ordinary causes — a corrupted download, a repackaged file, or tampering — and you cannot tell which from the hash alone. Delete the file, re-download once in case of corruption, and if the mismatch repeats, abandon that source entirely.
Remember the limit of the check: a matching hash proves integrity, not intent. Pair it with the signature and sandbox steps in How to Check a Download Before Installing, and pick sources that publish checksums in the first place — see Where to Get Free Software Safely.
Further reading