What a checksum file is, and why it travels with the download
A checksum file is a tiny text file that sits next to something you share, such as setup.exe and setup.exe.sha256. Inside is one line: the file's hash, two spaces and its name. Whoever downloads both can run a checker against them and know within seconds whether their copy matches yours.
Making one on Windows is fiddlier than it should be. There is no sha256sum command out of the box, and the built-in certutil prints header and footer lines around the hash, so redirecting its output into a file gives you something a strict checker will reject. You end up trimming text by hand for every file.
File Hash Extractor writes the files for you. Add a folder of release builds, pick the algorithm, press Extract, and each one gets its own sidecar in the same folder, named after it and formatted exactly as the Linux and macOS tools expect.
How to create a SHA-256 checksum file for each file
- Click Choose files, or Or a folder to queue everything directly inside one folder.
- Pick MD5, SHA-1, SHA-256 or SHA-512 in the drop-down. The extension of the files written follows it: .md5, .sha1, .sha256 or .sha512.
- Make sure the switch reads Write a .sha256 beside each file (the extension shown changes with your choice).
- Click Extract. Each row shows the name of the sidecar it wrote, and selecting a file shows the single line inside it.
A sha256sum alternative for Windows that others can verify
Because every sidecar uses the two-space layout, the person downloading can check it with the tool they already have: sha256sum -c setup.exe.sha256 on Linux or in Git Bash, shasum on macOS, or md5sum -c for an .md5 file. Hash checkers on Windows that understand sha256sum files read it too.
That is the point of writing a separate file per download rather than one long list: each pair can be uploaded, mirrored or attached to an email together, and the checksum never has to be retyped into a web page where a stray space could break it.
Just want to read the hashes, not write files?
Turn the Write switch off and the app becomes a plain reader. The checksums appear in the list and nothing is saved to disk, which is handy for a quick look before you commit to publishing.
Switch it back on when you are ready and run Extract again. A sidecar that is already there is replaced with the fresh value, so re-running after a rebuild never leaves an old hash next to a new file.
