How to verify a downloaded fileCompare its checksum with the one the publisher lists, and get both from a trusted place

TimeBinder adds a layer of protection against AI and human fraud and disputes.

The file stays on your device. Your browser makes a digital fingerprint of the file. TimeBinder records the fingerprint and the time, not the file.

Short answer

Calculate the file’s SHA-256 checksum after downloading and compare it with the value the publisher lists on their official site. If they match, the file is identical to what they published. Get the checksum from a separate, trusted source, and check any digital signature the publisher provides too.

Steps

1. Download the file and, separately, find the checksum on the publisher’s official page. 2. Calculate the checksum of your copy. On Windows, certutil -hashfile file SHA256 works; on macOS and Linux, shasum -a 256 file or sha256sum file. 3. Compare the two values character by character. 4. If they differ, delete the file and download again from the official site.

A checksum listed on the same compromised site as the file offers limited comfort, because both could have been changed. A publisher’s digital signature is stronger when you can check it. See what is a checksum.

Keeping a record of what you installed

If you need to show later which file you used, keep the file and note its checksum. A TimeBind records a SHA-256 fingerprint of the exact file and a time, anchored to Bitcoin. The fingerprint is made in your browser and the file is not uploaded. Try the SHA-256 file hash checker for the calculation.

A matching checksum does not show the software is safe or free of malware, only that it matches what was published.

Make a TimeBind: first one free →

First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.

Frequently asked questions

What if the checksum does not match?

Do not run the file. Download it again from the official source. If it still differs, contact the publisher.

Which checksum should I use?

Use whichever the publisher lists, and prefer SHA-256 over older MD5 or SHA-1 where you have the choice.

Is a matching checksum proof the file is safe?

No. It shows the file matches the published one. The published file itself could still be unsafe.

Can I check a file without uploading it?

Yes. Tools that calculate the hash in your browser or on your device do not need to upload the file. TimeBinder’s checker works in your browser.

Sources

NIST, Glossary: checksum.
TimeBinder, SHA-256 file hash checker.

Related guides and tools

Your file’s fingerprint, anchored to a global network secured by real electricity and cryptography.

Editing a file—including with AI—changes its fingerprint, not its existing network record.

How this works

Your file’s SHA-256 fingerprint, a short code worked out from its exact contents, is made in your browser, and the file itself stays on your device. A cryptographic commitment to that fingerprint, which may be combined with others, is then anchored in a block on the Bitcoin blockchain. Bitcoin is secured by proof of work: computers around the world spend real electricity to add each block, and changing an earlier block would mean redoing that work faster than the rest of the network. Until that block is confirmed, your proof is pending. Once the Bitcoin anchoring is confirmed, you can verify the proof against that recorded commitment. The confirmed record can then be checked; Pooled TimeBinds are checked through TimeBinder, while ASAP TimeBinds can also be checked independently. If you check the file later and its fingerprint still matches, that shows the file existed no later than the recorded time. The record doesn’t show who made the file, whether AI was used, or that its contents are true.

Your filestays on your device
FingerprintSHA-256
Network timestampon Bitcoin

Record a fingerprint of the file you rely on

Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the exact file you hold.

Open the app and sign in with email or Google.
Add your files. They stay on your computer.
Seal them and download your Proof of Time certificates.

Open TimeBinder →

First Pooled TimeBind free, no card, then from US$5. See pricing.

Related glossary entry: message digest.