Checksum Calculator

The Checksum Calculator computes cryptographic file hashes entirely in your browser using the Web Crypto API (crypto.subtle.digest), reading the file into an ArrayBuffer with the browser's FileReader so nothing is uploaded to a server, which matters when you are checking a multi-gigabyte ISO or disk image. It offers four algorithms, all SHA-family: SHA-1 (160-bit, flagged with a deprecation warning), SHA-256 (256-bit, the default and marked as the recommended standard), SHA-384, and SHA-512. There is deliberately no MD5 option, since SubtleCrypto does not implement it; if a download page only publishes an MD5 sum you cannot verify it here. A progress bar tracks the work in two halves, roughly 0 to 50 percent as the file is read and 50 to 100 percent while the digest is computed.

The tool has four modes. Calculate hashes a single dropped or browsed file and shows the hex digest with a copy button; switching the algorithm while a file is loaded automatically recomputes it. Verify lets you paste a publisher's expected checksum into a text box and renders a green 'Match!' or red 'Mismatch!' verdict; before comparing, the expected value is normalized by lowercasing it and stripping all whitespace, so trailing newlines or a copied 'SHA256 (file) = ...' fragment with spaces will not cause a false mismatch, but you must still pick the same algorithm the publisher used. Compare hashes two files in parallel (via Promise.all) and reports 'Identical!' or 'Different!' to confirm two copies are bit-for-bit equal. Batch adds many files at once, hashes them sequentially, flags any files that share a checksum under a 'Duplicates Found!' heading, and exports a checksums-{algorithm}.txt file in the standard 'hash␣␣filename' sha256sum format.

Understanding the threat model is important: a matching SHA-1 (or any single hash) only proves the file was not corrupted in transit or storage; SHA-1 is collision-broken, so it does not protect against a deliberate attacker, which is why the interface marks SHA-1 with a warning and SHA-256 with a checkmark. A SHA-256 (or stronger SHA-384/SHA-512) value obtained over an HTTPS connection is the meaningfully tamper-resistant check. When Verify reports a mismatch, the usual causes are choosing the wrong algorithm (a SHA-256 file against a published MD5 or SHA-1 sum will never match), an incomplete or corrupted download, a text file whose line endings changed when it was re-saved, or genuine tampering. The File Info panel shown alongside Calculate and Verify lists the file's name, size, MIME type, and last-modified date so you can confirm you grabbed the right file before trusting the verdict.