Short answer
Open PowerShell in the folder that contains the download and run Get-FileHash '.\FileName.exe' -Algorithm SHA256. Compare the complete result with the SHA-256 value on the official download page. Letter case does not matter. If even one character differs, do not run the file.
What SHA-256 means
SHA-256 turns the bytes in a file into a 256-bit summary called a hash or checksum. It is normally shown as 64 characters made from the numbers 0 through 9 and the letters A through F. The same file produces the same value. A changed file produces a different value.
A matching checksum shows that your copy has the same bytes as the copy used to publish that checksum. This is useful for spotting a damaged, incomplete or changed download.
What you need before checking the file
Keep the downloaded file closed. You need its exact path and the expected SHA-256 value published for that exact file on a trusted official page. PowerShell and Command Prompt are built into Windows, and this check normally does not require administrator access.
Check the file with PowerShell
1. Get the expected value from a trusted page
Use the product's official download page. Find the SHA-256 value for the exact version and file you downloaded. A Store package, standalone installer and portable file can have different values.
2. Find the downloaded file
Open File Explorer and go to the folder that contains the file. Check its full name. If a file with the same name already exists, the browser appends text such as (1) or asks whether to replace it.
C:\SHA256-Check, so no personal folder name appears. The default folder is Downloads unless you chose another location.3. Open PowerShell in that folder
Click the File Explorer address bar, type powershell, and press Enter. The prompt should open in the current folder. You can also open PowerShell first and use the full file path in the command.
4. Calculate the checksum
Replace the example name with the exact file name and run:
Get-FileHash '.\Osenpa-App-Setup.exe' -Algorithm SHA256
Keep the quotation marks when a file name contains spaces. PowerShell reads the file and prints the algorithm, hash and path. It does not open or install the file.
5. Compare every character
Compare all 64 characters with the published value. Uppercase and lowercase letters are equivalent, but missing, added or different characters are not. Do not compare only the beginning or end.
6. Stop if the values differ
Do not run the file. Confirm that the checksum belongs to the same version and download channel, remove the mismatched copy, then download it again from the official page. If a fresh copy still differs, contact the publisher before continuing.
Checkpoint: read the comparison result correctly
A 64-character calculated value is not automatically a match. The expected and calculated values must agree in every position; letter case is the only allowed difference. The PowerShell comparison below returns True when they match. False is a failed checkpoint, no matter how similar the two values look.
Let PowerShell compare the values
Manual comparison works, but PowerShell can check the full string for you. Paste the published value between the quotation marks:
$expected = 'PASTE_THE_64_CHARACTER_VALUE_HERE'
$actual = (Get-FileHash '.\FileName.exe' -Algorithm SHA256).Hash
$actual -eq $expected
True means the two text values match. False means they do not. This comparison is not a replacement for getting the expected value from the correct official page.
What a match does not prove
- It does not prove who published the file if the expected value came from an untrusted page.
- It does not create a digital signature or identify a Windows publisher.
- It does not remove a Microsoft Defender SmartScreen warning.
- It does not show whether the publisher's original file is safe to run.
Verification checklist
- The file came from the intended official channel.
- The published checksum belongs to the same file and version.
- The calculated value contains 64 hexadecimal characters.
- Every character matches before the file is opened.
Command Prompt alternative
If PowerShell is unavailable, open Command Prompt in the file's folder and run certutil -hashfile "FileName.exe" SHA256. Compare the checksum in the output with the same official value.