Does matching SHA-256 prove a file is safe?

No. A matching SHA-256 proves that your file contains the same bytes as the file that produced the published hash. It does not prove those bytes are harmless, and it proves provenance only if the reference hash came through a channel you already trust. An attacker who can replace both the download and the hash can make a malicious file match perfectly; a signed release or independently authenticated hash addresses that second problem.

What to take away

A checksum is strong evidence against accidental corruption and undetected byte changes.
Trust in the result is no stronger than trust in the place from which the reference hash was obtained.
Malware scanning, code signing and checksums answer different questions and should not be treated as substitutes.

The full explanation

Comparing a downloaded file against a published SHA-256 is genuinely worth doing, and it proves less than most people think. It establishes integrity against accident and, if the hash came from somewhere you trust, against tampering — but only that far. Reading what a file says about itself is a different question again. Read the complete guide for the reasoning, examples and definitions behind this answer.

Use the idea

File Checksum: SHA-256 and SHA-1check the sha256 checksum of a downloaded file WAV Audio File Inspectorwhat sample rate and bit depth is this wav file WAV Audio Trimmertrim a wav file without uploading it

Sources

FIPS 180-4 — Secure Hash StandardNational Institute of Standards and Technologychecked Jul 31, 2026
SHAttered — the first SHA-1 collisionCWI Amsterdam and Google Researchchecked Jul 31, 2026