How to Check a File's SHA-256 Hash on Windows With certutil or PowerShell, and What a Match Proves

To check a file’s SHA-256 hash on Windows, open Command Prompt and run certutil -hashfile followed by the file path and SHA256, or open PowerShell and run Get-FileHash with the path, then compare the result with the hash you were given. If the two match, the file has exactly the same contents as the one that was hashed; if a single character differs, the file has changed. BackupPaper shows the SHA-256 of every text message export it writes, so you, a lawyer or anyone you send the PDF to can check it later this way.

Both tools are built into Windows. Nothing needs to be installed.

Export an iPhone conversation as a PDF with a SHA-256 anyone can check on Windows.

Get it from Microsoft

What is a SHA-256 hash?

A hash is a short fingerprint computed from a file’s contents. SHA-256 produces a 64-character hexadecimal string. Microsoft’s documentation for Get-FileHash explains the key properties: if the hash values of two files are identical, the contents of the files are also identical, and changing even a single character in a file changes its hash. It also notes that some algorithms, including MD5 and SHA1, are no longer considered secure against attack, which is one reason SHA-256 is the default. Checked on 17 October 2026.

How do I check a hash with certutil?

certutil is a Windows command-line tool. Microsoft’s certutil reference documents the -hashfile verb, which generates and displays a cryptographic hash over a file, with the syntax certutil -hashfile InFile followed by an optional algorithm. Checked on 17 October 2026.

1. Open Command Prompt. Press the Windows key, type cmd, and press Enter.
2. Run the command. Type the following, replacing the path with your file’s path, in quotes if it contains spaces:

certutil -hashfile "C:\Users\you\Documents\Conversation with Sam.pdf" SHA256

3. Read the result. certutil prints a line with the hash, then a line saying the command completed successfully.
4. Compare. Put the printed hash beside the one you were given. Letter case does not matter in hexadecimal.

Tip: drag the file from File Explorer into the Command Prompt window to paste its full path.

How do I check a hash with PowerShell?

1. Open PowerShell. Press the Windows key, type PowerShell, and press Enter.
2. Run Get-FileHash. SHA-256 is the default, so no algorithm is needed:

Get-FileHash "C:\Users\you\Documents\Conversation with Sam.pdf"

3. Compare automatically if you want PowerShell to do the comparison:

(Get-FileHash "C:\path\file.pdf").Hash -eq "PASTE-THE-EXPECTED-HASH-HERE"

PowerShell prints True if they match and False if they do not. The -eq comparison ignores letter case.

How do I hash a whole folder of files?

If you received several exports, PowerShell can hash them all at once and save the list:

Get-ChildItem "C:\path\to\folder" -File | Get-FileHash | Select-Object Hash, Path | Export-Csv "C:\path\hashes.csv" -NoTypeInformation

Open hashes.csv in Excel and compare each row with the list you were given. Sorting both lists by file name makes the comparison quicker. Keep the CSV with the files, so a later check can be compared with this one.

Which method should I use?

	certutil	Get-FileHash
Where	Command Prompt or PowerShell	PowerShell
Default algorithm	Specify SHA256	SHA256
Built into Windows	Yes	Yes
Automatic compare	No, compare by eye	Yes, with -eq
Good for	Quick checks, older instructions that name certutil	Scripts, many files, automatic comparison

What does a matching hash prove, and what does it not?

A match proves one specific thing: the file you have now has the same contents as the file that was hashed. It does not prove:

• Who made the file or when. The hash says nothing about the author.
• That the contents are true. A hash of an inaccurate document matches just as well.
• That the original source was complete. For text messages, a hash shows the exported PDF has not changed since export. It does not show what was or was not in the phone.

That is why the hash should travel with context: where the file came from, when it was made, and how. A hash alone is a checksum, not a certificate.

How does BackupPaper use SHA-256?

BackupPaper saves one conversation from an iPhone backup on a Windows PC as a PDF or CSV.

1. Export the conversation. The PDF opens with a header showing the device, participants, service and date range, then every message with its time and sender, and records the export time.
2. Note the hash. The finished export shows its SHA-256, which you can check with certutil.
3. Keep a record. Write down or save the hash with a note of when and how you exported the file.
4. Share the file and the hash. Whoever receives the PDF can run certutil or Get-FileHash and compare.
5. Check again later. If the hash still matches, the PDF has not been edited since export.

The backup itself is opened read-only and never changed, and BackupPaper makes no network connections.

Try BackupPaper free for 15 days, export a conversation, and check its hash with certutil.

Get it from Microsoft

What are common mistakes when checking a hash?

• Hashing the wrong file. A copy with “(1)” in the name, or a file re-saved by a PDF viewer, will have a different hash. Hash the exact file you were given.
• Opening and saving. Some PDF readers offer to save changes when you close a file. Saving changes the hash.
• Comparing only the first few characters. Compare all 64.
• Mixing algorithms. An MD5 or SHA-1 value will never match a SHA-256 value. Check which algorithm was used.
• Sync apps. Files in a synced folder can be replaced by another version. Check the file you intend to rely on.

Frequently asked questions

Is certutil safe to run?

Yes. certutil -hashfile only reads the file and prints its hash. It does not change the file.

Why is my hash different from the one I was given?

The file has changed, or you are hashing a different file or using a different algorithm. Check the file name, path and algorithm.

Does BackupPaper make the PDF court-ready?

BackupPaper makes no claim about how a court, insurer or anyone else will treat the file. It records the device, participants, date range and export time, and the SHA-256 lets anyone check the file later. Ask your lawyer what they need. See print iPhone text messages for court for more context.

Can I check the hash on a Mac?

macOS has its own built-in command-line tools for this. This guide covers Windows only; the hash itself is the same on any system.

Does BackupPaper hash the CSV too?

BackupPaper shows the SHA-256 of every file it writes, PDF or CSV.

Try BackupPaper

BackupPaper is a one-time purchase in the Microsoft Store, with a 15-day free trial. Export a conversation, run certutil on it, and compare. For more, see export iPhone text messages to Excel, print iPhone text messages on Windows, or the BackupPaper product page.

A conversation saved as a file anyone can check.

Get it from Microsoft

iPhone is a trademark of Apple Inc. Microsoft, Windows and PowerShell are trademarks of the Microsoft group of companies. BackupPaper is not affiliated with or endorsed by Apple.

Last updated 17 October 2026. Published by Automata Labs, a software company in Canada.