system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Why do sites recommend verifying your download with SHA-256 - what does it do, and what could go wrong if I don't do it?

Often when I download files online, usually installers of sorts, the website recommends me to "verify data integrity with SHA-256" after I downloaded the file. What does that even mean, and what is it supposed to prevent?
gpt
SHA-256 is what's called a hashing function. The neat things about hashing functions:

* You can take an input of any size but the output (called a hash) is always a string of the same size.
* The same input will always produce the same output; but...
* Even very slightly different inputs will produce wildly different outputs; and,
* There's no practical way to predict what the output will be from the input (without actually running it through the function).

So you can take an entire file (even something like a zip file) and run it through the hashing function, producing a string of characters that represents that file. If someone makes even a small change to that file (say, changing the URL of a payment service or injecting a small virus) then the hash will be completely different.

So you put a file up for download and you publish the hash of the file. Someone else downloads that file, but they want to make sure no one has messed with it. They want to make sure it's *exactly* the file you meant to make available. If they run the file they have through the same hashing function you used and get exactly the same hash value, then they know they have a clean file; if the hash is different then something about the file was changed from what you published and that change is probably bad.