Quick reference for sha256sum, a tool to compute and verify SHA-256 checksums. SHA-256 is the common default for verifying downloads and file integrity.

Basic usage

• sha256sum file.img – print SHA-256 hash and filename.
• sha256sum file1 file2 – hash multiple files.
• echo -n "test" | sha256sum – hash data from stdin.

Common options

• -b – read files in binary mode (default on Linux).
• -t – read files in text mode (mainly for non-Unix systems).
• -c – check SHA-256 sums from a file.

Creating and verifying checksum files

• sha256sum file.img > file.img.sha256 – save checksum.
• sha256sum file1 file2 > checksums.sha256 – create checksum list.
• sha256sum -c file.img.sha256 – verify a single file.
• sha256sum -c checksums.sha256 – verify multiple files.

Tips

• Publish SHA-256 hashes over HTTPS, signed release notes, or another trusted channel.
• Users should compare the hash they compute with the published hash, not just “it downloaded fine”.
• For even stronger hashes, see sha512sum.