Short answer
Open the downloaded file's folder. Open PowerShell there and run Get-FileHash '.\FileName.exe' -Algorithm SHA256. Compare all 64 characters with the value on the official download page. If one character differs, do not run the file.
What SHA-256 means
SHA-256 turns a file's bytes into a 256-bit summary called a hash or checksum. It is normally shown as 64 hexadecimal characters using the numbers 0 through 9 and the letters A through F. The same bytes produce the same value; changed bytes produce a different value.
A matching checksum shows that your copy has the same bytes as the copy used to publish that checksum. This is useful for spotting a damaged, incomplete or changed download.
What you need before checking the file
Keep the downloaded file closed. You need its exact path and the expected SHA-256 value published for that exact file on a trusted official page. PowerShell and Command Prompt are built into Windows, and this check normally does not require administrator access.
Check the file with PowerShell
1. Get the expected value from a trusted page
Open the product's official download page. Find the SHA-256 value for the exact file you downloaded. A Store package, standalone installer, and portable file can have different values. You should see 64 letters and numbers.
2. Find the downloaded file
Open File Explorer and go to the folder that contains the file. Check its full name, including text such as (1). You should see the exact file you plan to check.
C:\SHA256-Check, so no personal folder name appears. The default folder is Downloads unless you chose another location.3. Open PowerShell in that folder
Click the File Explorer address bar. Type powershell and press Enter. You should see the same folder path in the PowerShell prompt. You can also open PowerShell first and use the full file path.
4. Calculate the checksum
Replace the example name with the exact file name and run:
Get-FileHash '.\Osenpa-App-Setup.exe' -Algorithm SHA256
Keep the quotation marks when the name contains spaces. You should see SHA256, a 64-character hash, and the file path. PowerShell does not open or install the file.
5. Compare every character
Compare all 64 characters with the published value. Uppercase and lowercase letters are equivalent. Missing, added, or different characters are not. Do not compare only the beginning or end.
6. Stop if the values differ
Do not run the file. Confirm that the checksum belongs to the same file and download channel. Remove the mismatched copy and download it again from the official page. If the fresh copy still differs, contact the publisher.
Checkpoint: read the comparison result correctly
A 64-character calculated value is not automatically a match. It must agree with the expected value in every position; letter case is the only allowed difference.
Let PowerShell compare the values
Manual comparison works, but PowerShell can check the full string for you. Paste the published value between the quotation marks:
$expected = 'PASTE_THE_64_CHARACTER_VALUE_HERE'
$actual = (Get-FileHash '.\FileName.exe' -Algorithm SHA256).Hash
$actual -eq $expected
True means the two complete values match. False means stop. This comparison is useful only when the expected value came from the correct official page.
Troubleshooting
PowerShell says the path was not found: copy the exact file name from File Explorer, keep quotation marks around names with spaces, and check that the prompt shows the same folder.
The browser is still downloading the file: wait until the temporary download name disappears and the final file size stops changing, then calculate the hash again.
The automatic comparison returns False: confirm the expected value belongs to the exact file and channel, download a fresh copy from the official page, and stop if the new copy still differs.
What a match does not prove
- It does not prove who published the file if the expected value came from an untrusted page.
- It does not create a digital signature or identify a Windows publisher.
- It does not remove a Microsoft Defender SmartScreen warning.
- It does not show whether the publisher's original file is safe to run.
Verification checklist
- The file came from the intended official channel.
- The published checksum belongs to the same file and version.
- The calculated value contains 64 hexadecimal characters.
- Every character matches before the file is opened.
Command Prompt alternative
If PowerShell is unavailable, open Command Prompt in the file's folder and run certutil -hashfile "FileName.exe" SHA256. Compare the checksum in the output with the same official value.