Convenient cross-platform help on checking secure hashes like SHA-256

For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick.

Example of Get-FileHash usage:

C:\Windows> Get-FileHash -Algorithm md5 .\notepad.exe

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
MD5             24DA05ADE2A978E199875DA0D859E7EB                                       C:\Windows\notepad.exe

Supported algorithms are SHA1, SHA256, SHA384, SHA512, MACTripleDES, MD5 and RIPEMD160.

The one tool that comes to mind, particularly for Unixes (or however you're supposed to pluralise that) is openssl:

openssl dgst -sha256 path/to/file

The openssl dgst command provides a lot of common hashing options, and openssl is installed on most Unix systems by default and is also available for Windows. I believe it ships with OSX too. I agree, it is a less than ideal situation for Windows to ship without such a tool.

As for GUI tools, I do not, personally know of any other than HashCalc, which you have already mentioned.

In a mixed Windows/Unix environment, what I use for common cryptographic algorithms is:

• OpenSSL for many calculations, especially hashes (but not HMAC) and X.509 certificate manipulations.
• Python's hashlib and hmac for SHA and HMAC.

Unfortunately, neither is provided with Windows, they require a separate installation.

Here's a simple one-liner to compute the HMAC of a file using Python. Type the key in hexadecimal in the terminal (or pass it on standard input with echo … |, but beware that the key will then end up in the shell history). The file is read into memory, which won't do for large files.

python -c "import binascii, hashlib, hmac, sys; print hmac.new(binascii.unhexlify(str.strip(sys.stdin.readline())), open(sys.argv[1]).read(), hashlib.sha256).hexdigest()" myfile.dat

On Windows, a simple hash verifier (supporting SHA and a few more, and HMAC) that's usable by a non-technical person is SlavaSoft HashCalc. Unfortunately, it's not open-source, so you may not have the utmost confidence it its operation.