Nothing is uploaded. When you drop, browse, fetch or type input, the tool reads it locally with the browser’s File API and computes the hash in memory on your device, streaming the file in 4 MB chunks so even multi-gigabyte files do not freeze the tab. The strong algorithms (SHA-1, SHA-256, SHA-384, SHA-512) run on the browser’s built-in Web Crypto engine, and MD5 and CRC32 use bundled JavaScript implementations; there is no server, API, database or tracking in the processing path, so a private document, disk image or key file stays on your machine. The tool works offline once cached, and closing the tab discards everything. The one case where data touches the network is if you paste a remote URL for the tool to fetch, and even then the response is downloaded straight into your browser and hashed there, never sent anywhere else. The only optional network use anywhere on the site is consent-gated advertising, which never sees your file.

For anything security-related — confirming a download was not tampered with, matching a publisher’s checksum, or comparing files you do not fully trust — use SHA-256, which is the modern default, or SHA-512 if a project publishes that. MD5 and SHA-1 are cryptographically broken: researchers can craft two different files with the same MD5 or SHA-1 digest, so a match no longer guarantees the file is genuine. They are still perfectly useful for detecting accidental corruption, deduplicating files, or matching a legacy checksum that was only ever published in MD5. CRC32 is not a cryptographic hash at all — it is a fast error-detecting code used inside gzip, zip and PNG — so use it only to catch random bit-flips, never for security. This tool lets you compute several at once, so you can generate SHA-256 for trust and MD5 for a legacy manifest in the same pass.

Add the downloaded file so it is hashed, then copy the checksum the publisher lists next to the download and paste it into the Verify box. The tool detects which algorithm it is from the string length — 32 hex characters means MD5, 40 means SHA-1, 64 means SHA-256, 96 means SHA-384, 128 means SHA-512 and 8 means CRC32 — compares it against the matching computed digest, and shows a green Match or a red Mismatch for each file. You can also paste an entire GNU-style checksums manifest (one “hash  filename” line per file, as produced by sha256sum), and it will line up every listed hash against the queued files by name and report each row. A Match means the file is byte-for-byte what the publisher released; a Mismatch means it was corrupted in transit or altered, and you should re-download it.

The calculator reads each file in 4 MB slices and updates the streaming hashers chunk by chunk, yielding to the browser between chunks so the interface keeps a live progress bar and the tab does not lock up even on multi-gigabyte disk images or videos; it also reports elapsed time and throughput. Besides local files you can hash text — type or paste any string and it is hashed as a UTF-8 blob, handy for checking a snippet against a known digest — or paste a URL and the tool fetches the file into the browser and hashes it there, provided the remote server allows cross-origin requests (CORS); if it does not, you get a clear message rather than a silent failure. You can queue many files at once; they are processed one at a time so memory stays under control, and results, copies and exports update as each finishes.