Checksum Calculator

The tool has four modes. Calculate hashes one file and shows every ticked algorithm at once, with the file name, size, type and modified date alongside. Verify checks a file against something a publisher put on their site. Compare hashes two files and says whether they are byte for byte identical. Batch hashes a list of files, groups any that share a digest so duplicates fall out, and exports the result in the GNU `hash name` format that `sha256sum -c` reads back.

Verify accepts a digest in whatever shape you copied it. Bare hex, upper or lower case, with spaces or colons between the bytes, base64, a whole GNU line including the filename, or the BSD form `SHA256 (file) = ...` that macOS `shasum -p` prints. It works out which algorithm could have produced a digest of that length, tells you which one matched, and compares in constant time so the answer cannot be pulled out a byte at a time by timing. It also takes a whole checksum file: load a SHASUMS, .sha256 or .md5 file, add the files it names, and every line is checked and reported as matched, failed, or not provided, with any files you added that the checksum file does not mention listed separately. Loading a checksum file also turns on whichever algorithm its lines actually use.

File size is handled honestly. CRC-32, CRC-32C, Adler-32 and MD5 stream a chunk at a time and work at any size. Web Crypto, which is what makes SHA fast, has no incremental interface, so a SHA digest reads the whole file into memory up to a gigabyte and switches to a JavaScript streaming digest above that. The fast path runs at roughly 600 MB/s and the fallback at roughly 120 MB/s, and progress is reported from the bytes actually read rather than in two halves. A 2.5 GB file hashes in about a minute and matches openssl; a browser cannot read a file that size into a single buffer at all, which is what the older behaviour tried to do. Every run can be cancelled.

When Verify reports a mismatch the usual causes are, in order: the download is incomplete or corrupted, the digest was copied from a different release, a text file whose line endings changed when it was re-saved, or genuine tampering. The tool prints the digest it computed next to the one you pasted so the two can be compared by eye.