File integrity: SHA-256 checksums Pro

FileDeck records a SHA-256 checksum for each document’s file and shows it on the document page, so visitors can verify that the file they downloaded is exactly the file you published. For protected files, an optional setting goes further: FileDeck re-verifies the checksum on every download and refuses to serve the file if it has changed. Together these give you tamper evidence at both ends of a download.

FileDeck Pro — this feature is included in all Pro plans. See pricing

What is a checksum for?

A SHA-256 checksum is a fingerprint of a file’s exact contents. Change a single byte and the checksum changes completely. Because FileDeck displays the checksum on the document page, a visitor can compute the checksum of their downloaded copy and compare — if the values match, the file arrived intact and unmodified. This matters for anything where authenticity counts: signed contracts, published financials, installers, audited policies.

Recording happens automatically. When a file is attached to a document, FileDeck computes and stores its checksum; when you replace the file, the checksum is recorded for the new version.

How do I turn on verify-on-download?

For protected files, you can have FileDeck check the file against its recorded checksum every time it is downloaded:

1. Go to Documents → Settings → Privacy.
2. Enable the option to verify a protected file’s checksum on every download.
3. Save your changes.

From then on, if a protected file on disk no longer matches its recorded checksum — because it was altered, corrupted, or swapped outside FileDeck — the download is refused instead of silently serving a changed file.

Should I enable per-download verification?

It is the safest setting, but it adds work: FileDeck must read and hash the whole file on every download, which is extra effort for large files on busy sites. Enable it when integrity is the point — regulated documents, evidence, releases people act on. Skip it if your library is mostly large media files and the visible checksum on the document page is assurance enough.

FAQ

How does a visitor actually verify a download?

They compute the SHA-256 of the downloaded file (macOS and Linux ship shasum -a 256; Windows has certutil -hashfile file SHA256) and compare it with the checksum shown on the document page.

Does verify-on-download cover unprotected files?

No. Per-download verification applies to protected files served through FileDeck’s download pipeline. Every document still gets a recorded, visible checksum.

What happens when I replace a document’s file?

FileDeck records a checksum for the new file, and the document page shows the current file’s checksum.