Checksum

The file is read as an ArrayBuffer and passed to crypto.subtle.digest("SHA-256", bytes) — the browser's own implementation of FIPS 180-4. The digest bytes are printed as lowercase hex. SHA-512 and SHA-1 come from the same call with a different name, run one after the other. There is no MD5: Web Crypto does not offer it.

To compare, the tool picks every run of hex digits out of what you paste, ignoring case, and keeps the runs as long as a digest: 40 for SHA-1, 64 for SHA-256, 128 for SHA-512. So a bare hash, a line out of a SHA256SUMS file, or a BSD-style SHA256 (file) = hash line all work, and digits in the file name do not get in the way. A hash printed as bytes split by spaces, colons or dashes is joined back together. If a run equals one of this file's digests, the tool says which algorithm matched. When the only hash you pasted is 32 digits, an MD5, the tool says it cannot check it rather than calling it a mismatch; the same goes for 56 digits (SHA-224) and 96 (SHA-384).

crypto.subtle needs a secure context: opened over https or from file:// it works; over plain http on a remote host it does not, and the tool says so rather than showing a wrong answer. Web Crypto hashes in one pass, not in pieces, so the whole file and a copy of it have to fit in memory. Files above 512 MiB (536,870,912 bytes) are refused before reading, and the three digests run one at a time, which keeps the peak near 1 GiB. A device short of memory can still fail below the limit; the tool then says the browser could not read or hash the file. Picking another file while one is being read drops the first.

The Dark button remembers its setting in this browser's local storage. Nothing you type or drop into the page is stored.