File checksum & hash
Check that the file you downloaded is the file they published. Paste the SHA-256 from the vendor's page, drop the file, get a match or a mismatch.
Every other online hash calculator asks you to upload the file to a stranger's server in order to prove the file has not been tampered with, which is a strange way to go about it. This one uses crypto.subtle.digest, the hashing built into your browser since about 2014. The file is read off your disk, hashed in the tab, and never sent anywhere — the uploads counter in the top bar stays at 0 while you use it.
Questions people ask
Is my file uploaded to work out the hash?
No, and that is the entire point. The hashing is done by crypto.subtle.digest, which is part of the browser itself, so the bytes go from your disk to your own tab and nowhere else. Watch the uploads counter in the top bar, or open your dev-tools Network tab while you drop a file — you will see nothing leave. Uploading a file to a stranger to prove it has not been tampered with was always the odd part of this genre of website.
Can it do MD5?
No. The browser's crypto API gives us SHA-1, SHA-256, SHA-384 and SHA-512 and deliberately excludes MD5, which is broken. We could bundle a hand-rolled MD5 to fill the gap, but that means shipping a few hundred lines of unaudited maths so you can compute a hash that proves nothing. If a project only publishes an MD5, ask them for a SHA-256, or use md5sum on your own machine.
Why is SHA-1 offered if it is broken?
Because plenty of older projects only ever published a SHA-1, and matching what they published is still useful for spotting a truncated download. It is not useful against an attacker: SHA-1 collisions have been demonstrated since 2017, so a matching SHA-1 does not prove the file is the one the author signed. If you have a choice, take the SHA-256.
How big a file can it handle?
Up to 2 GB. The browser's digest function has no streaming mode — it takes the whole file as one block of memory — so the file has to fit in the tab's memory in one piece, and the tab will briefly go quiet while the maths runs. Above 2 GB the page refuses the file rather than crashing on you. For a 4 GB ISO, shasum -a 256 file.iso in a terminal is the right tool.
Is there a file-size limit, a signup or a paid tier?
None of those. The paid tiers on other checksum sites exist because they pay for the bandwidth of your upload and the CPU that hashes it — a 700 MB ISO costs them real money, so it sits behind a limit or an account. Here the work happens on hardware you already own, so there is nothing to meter. The only limit is your own memory, described above.
How this works & why it’s private
A checksum is a short fingerprint of a file. Change one byte anywhere and the fingerprint changes completely, so if the SHA-256 you compute matches the SHA-256 the publisher listed on their download page, you have the same file they released — not a truncated download, not a mirror that swapped the installer.
The tool reads your file in 8 MB slices with Blob.slice so the progress bar can move, then hands the assembled bytes to crypto.subtle.digest. That last step is the honest limitation: WebCrypto has no streaming digest, so the whole file must be in memory at once, which is why there is a 2 GB ceiling and why the tab pauses at the end of a large file. The alternative — a hand-written or WebAssembly hash implementation — is a lot of code to audit for a job the browser already does correctly.
Paste an expected hash and it is compared case-insensitively after trimming, and a whole line copied from shasum -a 256 output works too — the hash is pulled out of it. The length of what you paste also tells us the algorithm: 40 hex characters is SHA-1, 64 is SHA-256, 96 is SHA-384, 128 is SHA-512, so the algorithm switches itself and you do not have to know that off by heart.
Nothing is transmitted at any stage. There is no server involved beyond the one that sent you this page, and once loaded the page works offline.