A checksum lets you compare a file's contents with a reference value. It's useful when a publisher lists a digest next to a download, or when you want to check that two copies contain the same bytes. The important part is using the same algorithm and getting the reference from a source you trust.
A matching hash doesn't tell you whether a program is safe to run. It tells you the file matches the reference you compared it against.
Try a three-byte example
Download checksum-a.txt. It contains exactly abc, with no newline. Open File Checksum, leave the algorithm at SHA-256, and choose the file. The digest should be:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Paste that value into Expected hash (optional). The comparison should say Hash matches. Letter case and surrounding spaces are ignored, so uppercase hex digits are fine. Leave out the filename, any algorithm label, and spaces in the middle of the digest.
Now select checksum-b.txt. It contains abd, also without a newline. Only the last byte changed, but its SHA-256 digest is:
a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9
Leave the first expected value in place. This time the page should say Hash does not match. I calculated both reference values separately with Node's crypto library, then checked them against the browser tool in Chromium 146 on Windows. You can reproduce the first result with PowerShell:
Get-FileHash -LiteralPath .\checksum-a.txt -Algorithm SHA256
If you create the sample yourself in an editor, watch for a trailing newline or a byte-order mark. Those are bytes too, and they'll give you a different result. Renaming the file doesn't change the digest.
Match the algorithm before comparing
This tool offers MD5, SHA-1, SHA-256, SHA-512, and CRC32. A digest from one can't be compared with a digest from another. If a publisher gives you SHA-256, choose SHA-256.
For security-sensitive comparisons, don't swap in MD5, SHA-1, or CRC32 for a stronger algorithm the publisher specifies. CRC32 is good for catching ordinary data errors, but it can't tell you a file is authentic. NIST's hash function overview describes the SHA-2 family and the move away from SHA-1. The tool includes several algorithms so you can match existing references, not because they all provide the same guarantees.
Changing the algorithm recalculates the hash for the selected file. Larger files are read in 2 MiB chunks, with progress shown while the worker runs. Cancel stops the calculation. The tool doesn't need to recognize the file format. An archive, image, or executable is still a sequence of bytes to hash.
Compare the file you downloaded
If the reference is for a ZIP, check the ZIP before extracting it. An extracted file has its own bytes and won't match the archive's digest. Use Zip and Unzip afterward if you need its contents.
Think about where the expected digest came from. A compromised site could replace both the download and the value shown next to it, and the hashes would still match. A checksum is a practical integrity check. It doesn't vouch for the file or prove who made it.
If they don't match, first check the algorithm, the file you selected, and whether the download finished. Then get a fresh copy from the publisher. Don't edit the expected value until the page says what you hoped to see. The mismatch is the useful part of the check.