About this lab

Pikkola, tool No. 12

A hash is only useful if it is the same everywhere. Here is what runs, and what does not.

Five algorithms, one page

Every checksum page we used had a box, an advertisement and its own domain for each algorithm. Checking one release meant pasting the same file into three of them, at three different speeds, with three different ideas of progress. This page takes the file once.

How a large file is hashed

The file is opened through the browser's own file reader and read in slices of 8 MB. Each slice updates two running hash states, one for SHA-256 and one for MD5, so the file is read once and never held in memory whole.

A 4 GB image takes a few minutes in JavaScript. That is why there is a progress bar and a Stop button, and why the digests appear only when the last slice has been read.

Where the arithmetic comes from

SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser's Web Crypto interface, except where a streaming pass is needed, and then the published algorithm is implemented in the page. MD5 is implemented here because browsers dropped it, and download pages did not.

Nothing is approximated. A digest from this page matches sha256sum, shasum -a 256 or certutil on the same bytes.

What it will not do

It will not verify a signature, generate a key or encrypt anything. The token panel reads the header and the payload and shows the signature as text, because a decoder that pretends to verify is worse than one that says it does not.

It keeps no history. A key typed into the HMAC panel lives in the field until the tab is closed.

If something is wrong

Write to hello@pikkola.com with the input and the digest you expected. For a checksum tool that is the whole bug report.