What is the SHA256 file format?
A .sha256 file is a plain-text checksum sidecar that holds one or more SHA-256 digest lines for verifying file integrity. SHA-256 (Secure Hash Algorithm 2, 256-bit output) was standardized by NIST in FIPS 180-2 (2002) and refined in FIPS 180-4 (2015); it remains cryptographically sound as of 2026, unlike the broken .md5 checksum.
Each line follows the layout produced by sha256sum (GNU coreutils): a 64-character lowercase hexadecimal digest, a two-space separator for text mode (or * for binary mode), then the filename. Single-file sidecars may omit the filename and contain only the 64-character hex string. Multi-file manifests list one entry per line.
.sha256 files are generated and verified using built-in OS tools:
- Linux/macOS:
sha256sum --check file.sha256orshasum -a 256 -c file.sha256 - Windows:
certutil -hashfile file.iso SHA256orGet-FileHash file.iso -Algorithm SHA256in PowerShell - GUI tools such as FileVerifier++, RapidCRC Unicode, and GtkHash also read them.
Because the file is plain UTF-8 text, it opens in any text editor. Projects requiring both integrity and authenticity often pair a .sha256 manifest with a GPG .asc signature file. SHA-256 has no known practical collisions, making it far stronger than MD5 (cryptographically broken) or CRC-32 (trivially forgeable).
Security & safety
RISK: LOWA .sha256 file is harmless plain text and cannot execute any code. The important security point is what SHA-256 proves: it reliably detects both accidental corruption and deliberate tampering, unlike MD5 and CRC-32. However, the .sha256 file must come from a trustworthy source (official HTTPS page, signed channel); if an attacker controls both the file and the published hash, they can publish a matching pair. For maximum assurance, also verify a GPG/PGP .asc signature.
Format details
in a nutshellPrograms that open SHA256 files
Windows5 apps
FileVerifier++
Free Open the .sha256 in FileVerifier++ via File > Open; it computes and compares SHA-256 hashes for all listed files automatically. 
Notepad
Built-in Opens the .sha256 as plain text to read the expected hash, but does NOT verify anything; use certutil or Get-FileHash separately.
certutil (built-in)
Built-in Run 'certutil -hashfile yourfile.iso SHA256' in Command Prompt, then compare the output to the 64-char value in the .sha256 file.
PowerShell Get-FileHash
Built-in Run 'Get-FileHash yourfile.iso -Algorithm SHA256' in PowerShell; the Hash column is the SHA-256 value to compare against the .sha256 file.
RapidCRC Unicode
Open-source Drag the .sha256 into RapidCRC to verify listed files; also generates SHA-256 sidecar files. Supports MD5/SHA-1/SHA-256/SFV. 
macOS2 apps
checkSum+
Free Drag the file in to compute its SHA-256 and compare against the .sha256 value; GUI alternative to Terminal commands.
shasum (Terminal, built-in)
Built-in Run 'shasum -a 256 -c file.sha256' in the folder with the file (reports OK or FAILED). Or 'shasum -a 256 yourfile' to compute a hash for manual comparison. 
Linux2 apps
sha256sum (GNU coreutils)
Open-source Run 'sha256sum -c file.sha256' in the folder with the target file (prints OK or FAILED per entry). To generate: 'sha256sum yourfile > yourfile.sha256'.
GtkHash
Open-source Select SHA-256 in GtkHash, drag a file in, compute the hash, and compare to the value in the .sha256 file. GUI option for desktop Linux. Technical details
deep spec| Hash algorithm | SHA-256 per NIST FIPS 180-4 (2015); 256-bit output represented as 64 lowercase hexadecimal characters |
| Line format | 64-char hex digest + two-space separator (text mode) or ' *' (binary mode) + filename; single-hash files may omit the filename |
| File encoding | Plain ASCII/UTF-8 text |
| Binary signature | None - plain text, no magic bytes |
| Typical size per entry | 66-130 bytes; multi-file manifests scale linearly at one line per file |
| Multi-file support | One line per file; no defined upper limit on entry count |
| Mode indicator | Two spaces = text mode; space-asterisk (' *') = binary mode, mirroring GNU sha256sum output |
| Linux/macOS verification | sha256sum --check file.sha256 or shasum -a 256 -c file.sha256 |
| Windows verification | certutil -hashfile file SHA256 or Get-FileHash (PowerShell) |
| Collision resistance | No known practical collisions as of 2026; far stronger than MD5 (cryptographically broken) or CRC-32 (easily forgeable) |
| MIME type | text/plain (unofficial alternative: text/x-sha256sum) |
| Common pairing | Often distributed alongside a GPG .asc signature file to combine integrity checking with authenticity verification |
| Released | SHA-256 algorithm published 2001 (FIPS 180-2/180-4); .sha256 sidecar convention in wide use since approximately 2003-2005 |
| Latest version | FIPS 180-4 (2015) - no versioned file format |
| Open standard | Yes · royalty-free |
| Specification | csrc.nist.gov |
SHA256 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SHA256 files.
