The short answer
Compute SHA-256 from the original bytes and the downloaded bytes and compare the full digests. A mismatch shows the byte sequences differ. A matching digest is a strong practical integrity check, but it does not establish who authored a file or whether it is safe to run.
Choose a trusted reference
A comparison needs a known original or a reference digest obtained through a trusted channel. Computing a hash only after download gives you a fingerprint of that download; by itself it cannot establish what arrived was intended. Keep the reference separate from the transfer under review.
Compare the complete result
SHA-256 produces a 256-bit digest represented here as 64 hexadecimal characters. Use the full value rather than a short visible prefix. The local checksum tool processes selected files in your browser and can compare the output with a supplied reference.
Keep integrity distinct from trust
Two filenames can contain the same bytes, and two equally named files can differ. Hashes concern content, not the filename. A malicious file can also have a valid checksum. These tools are not a signature verifier, a malware scanner or a source of publisher identity.
Checklist
- 1Keep a trusted original or full reference digest.
- 2Compute the digest on the downloaded bytes.
- 3Compare all 64 hexadecimal characters.
- 4Review provenance and file safety separately.
Good questions. Clear answers.
Does renaming a file change its SHA-256?
Renaming alone does not change its content bytes, so its content checksum remains the same.
Does a matching checksum mean a file is harmless?
No. Integrity and safety are separate questions.