How it works
Hashing uses @noble/hashes, an audited pure-JavaScript library, so it runs under this site’s strict security policy with no WebAssembly. Files are read in 4 MB slices and fed to every selected algorithm at once, so a multi-gigabyte firmware image never has to fit in memory.
Paste a published checksum in Expected hash, in hex (any case) or Base64, to compare.
Which algorithm?
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128 bit | broken for security; fine as a corruption check |
| SHA-1 | 160 bit | broken for security (collisions since 2017) |
| SHA-256 | 256 bit | current default |
| SHA-384 / SHA-512 | 384 / 512 bit | current; faster than SHA-256 on 64-bit CPUs |
For passwords, use a slow password hash (Argon2, scrypt, bcrypt), never a plain digest.
HMAC
With a key, each output becomes HMAC-<algorithm> (RFC 2104): the digest that webhook signatures (GitHub, Stripe) and JWT HS256 use. The key and the text are kept in memory only, never stored.