How it works
SHA-1, SHA-256, and SHA-512 are computed by the browser's built-in crypto.subtle.digest. MD5 is not in WebCrypto, so we ship a small pure-JS implementation. Files are read with file.arrayBuffer() entirely in your browser.
FAQ
Why not use MD5 for password storage? MD5 has known collision attacks and is far too fast (GPUs compute billions of MD5/s). For passwords use Argon2, scrypt, or bcrypt. MD5 here exists only because some legacy file-integrity systems (Maven, S3 ETags, ISO checksums) still require it.
Is my file uploaded? No. Hashing happens in your browser via WebCrypto SubtleCrypto. The file is read with FileReader and never sent over the network. Large files (hundreds of MB) may take a few seconds.
Which hash should I use to check a download? Use the strongest hash the publisher provides. SHA-256 is the practical default in 2026 — it is fast, well-supported, and no realistic collision attack exists. SHA-512 is even stronger. SHA-1 and MD5 should only be trusted for non-adversarial integrity checks.