LocalUtils field note · Calculate file checksums and compare them exactly
Calculate file checksums and compare them exactly
A checksum is a repeatable fingerprint of file bytes. Matching a value published by a trusted source can show that your downloaded bytes match that source's reference.
A checksum does not prove that a file is harmless, that the publisher is trustworthy, or that a reference value was not replaced by an attacker. The comparison is only as trustworthy as the channel that supplied the expected digest.
Quick start
- Obtain the expected checksum from the software publisher or another authenticated channel.
- Choose the same algorithm named by the publisher; values from different algorithms cannot be compared.
- Select the file and let the worker finish without modifying or re-downloading it.
- Compare the complete hexadecimal strings, preferably by copy/paste into a constant-time or exact text comparison rather than checking only the first characters.
device → browser engine → result
What the browser does
A Web Worker reads the file and calculates selected algorithms, including CRC32, MD5, SHA-1, SHA-256, SHA-384, SHA-512, and SHA-3 variants implemented by the bundled libraries.
The file bytes remain in the browser processing path. Older algorithms remain useful for compatibility and accidental-corruption checks, but MD5 and SHA-1 are not suitable choices for new collision-resistant security designs.
Inputs and outputs
- Input: any local file readable by the browser File API.
- Output: hexadecimal digest strings for the selected algorithms.
- A digest identifies exact bytes; changing one byte, metadata field, or archive timestamp normally changes the result.
Limits to know before you start
- A matching digest cannot detect malware when the trusted reference describes the same malicious file.
- CRC32 is an error-detection checksum, not a cryptographic integrity proof.
- MD5 and SHA-1 have known collision weaknesses.
- Large files take time to read and still consume device I/O and processing resources.
Troubleshooting
- If values differ, confirm algorithm, file version, architecture, decompression state, and whether the publisher hashes an archive or its contents.
- Copy the checksum without spaces, labels, or hidden line breaks.
- Recalculate after a fresh download only when the expected value comes from a trusted independent source.
Verification checklist
- Confirm the reference checksum was obtained over HTTPS or a signed release channel.
- Compare the entire digest with matching capitalization ignored only when the representation is hexadecimal.
- For high-assurance software, verify a digital signature in addition to the checksum.
Questions people ask
Which algorithm should I choose?
Use the exact algorithm supplied by the publisher. For new cryptographic integrity references, SHA-256 or a stronger modern digest is generally preferable to MD5 or SHA-1.
Does a matching hash mean a file is safe?
No. It only means the bytes match the referenced bytes; it says nothing by itself about intent or malware.
Why did renaming not change the hash?
The tool hashes file contents, not the local filename. Changing embedded metadata or rebuilding the file can change its bytes.