How to Build a Browser-Based File Integrity Checker with JavaScript

You can calculate a selected file’s SHA-256 checksum entirely in a browser with JavaScript: read the file as an ArrayBuffer, pass its bytes to crypto.subtle.digest(), and render the result as hexadecimal. That gives you a digest to compare with a trusted checksum; it does not, by itself, prove who supplied the file or that the reference checksum is authentic.

Build a basic browser file checker

Save the following as an HTML file and open it in a browser that exposes Web Crypto in the current context. The example hashes the first selected file and inserts the result with textContent, so the filename and digest are treated as text rather than HTML.

#	Preview	Product	Price
1		TSUBOSAN Japan-Hardness Tester Checker File HRC40-HRC65 Set of 6	$69.96	Buy on Amazon
2		4pcs Self Adhesive Acrylic Hinges, Folding Furniture Hardware	$14.15	Buy on Amazon

<label for="file">Choose a file to hash</label>
<input id="file" type="file">
<output id="result" aria-live="polite"></output>

<script>
const input = document.querySelector("#file");
const output = document.querySelector("#result");

function toHex(buffer) {
  return Array.from(new Uint8Array(buffer), (byte) =>
    byte.toString(16).padStart(2, "0")
  ).join("");
}

input.addEventListener("change", async () => {
  const file = input.files?.[0];
  if (!file) {
    output.textContent = "No file selected.";
    return;
  }

  output.textContent = "Hashing…";
  try {
    const bytes = await file.arrayBuffer();
    const digest = await crypto.subtle.digest("SHA-256", bytes);
    output.textContent = `${file.name}: ${toHex(digest)}`;
  } catch (error) {
    const message = error instanceof Error ? error.message : String(error);
    output.textContent = `Could not hash this file: ${message}`;
  }
});
</script>

What each step does

1. input.files?.[0] gets the first file the user selected. The page can read it after selection without needing a server upload.
2. file.arrayBuffer() asynchronously reads the file’s bytes into memory.
3. crypto.subtle.digest("SHA-256", bytes) computes a digest and resolves to an ArrayBuffer.
4. toHex() formats each digest byte as two hexadecimal characters, preserving leading zeroes.
5. The output reports the filename alongside the digest. Compare the digest, not the filename, with the checksum reference.

SHA-256 produces a 256-bit digest, conventionally written as 64 hexadecimal digits. MDN demonstrates this file-hashing flow and hexadecimal representation in its SubtleCrypto.digest() documentation and its file-hashing example.

Compare the result with an expected checksum

Obtain the expected SHA-256 value from a source you trust independently of the file itself, then compare it character for character with the displayed hexadecimal digest. Differences in letter case do not change a hexadecimal value, but whitespace or missing digits can cause a mistaken comparison. A small checker can normalize case and trim surrounding whitespace:

#1 Best Overall

Sale

TSUBOSAN Japan-Hardness Tester Checker File HRC40-HRC65 Set of 6

• Item Category: Hardware Handle
• Item Trademark: TSUBOSAN
• Manufacturer: TSUBOSAN FILE CO;, Ltd
• Manufacturer: TSUBOSAN FILE CO;, Ltd

$69.96

Buy on Amazon

function matchesExpected(actualHex, expectedHex) {
  return actualHex.toLowerCase() === expectedHex.trim().toLowerCase();
}

This comparison answers only whether the bytes produce the same digest as the reference value. A hash is not encryption: it does not conceal or recover the file. A match also does not identify the publisher or establish that the expected checksum is genuine. If an attacker can replace both a file and the checker or checksum reference served from the same site, that site can report a misleading result. MDN discusses this trust limitation in its file-verification guidance.

Choose a digest that matches the published checksum

The algorithm must match the one used to create the expected checksum. Web Crypto’s digest() supports SHA-1, SHA-256, SHA-384, and SHA-512. MDN warns that SHA-1 is vulnerable for cryptographic applications; for a new general-purpose file checksum example, SHA-256 is a practical default and is the algorithm used above.

MDN documents the supported names, output behavior, and SHA-1 warning in SubtleCrypto.digest(). The API does not provide comparative processing-speed figures, so this table makes no speed claim.

Handle multiple files

Change the input to allow multiple selections:

<input id="file" type="file" multiple>
<output id="result" aria-live="polite"></output>

Then process files one at a time and assemble plain-text output. Sequential processing avoids deliberately retaining a separate list of all file buffers, although each individual file still has to be read in full by digest().

Rank #2

4pcs Self Adhesive Acrylic Hinges, Folding Furniture Hardware

• Invisible attachment: the transparent double sided tape ensures that the adhesive remains discreet, preserving the visual integrity of your projects,DIY drawer hinge,DIY cabinet hinge
• Versatile material compatibility: suitable for a wide range of materials, including acrylic boards, cabinet boards, glass, metal, tiles, and cardboard, making it highly adaptable,clear furniture hinge,drawer adhesive hinge
• Loose leaf design: allows for easy organization and categorization of documents, enhancing efficiency and accessibility,self-adhesive hinge clear,small hinges for crafts
• Convenient hinge mechanism: the hinge design allows for smooth flipping and folding, enhancing usability and functionality,small clear mini invisible hinges,DIY transparent hinge
• Transparent tape: the clear double sided tape ensures that the adhesive remains unobtrusive, preserving the aesthetic of your projects,cabinet hinge,furniture clear hinge

$14.15

Buy on Amazon

input.addEventListener("change", async () => {
  const files = Array.from(input.files ?? []);
  if (files.length === 0) {
    output.textContent = "No files selected.";
    return;
  }

  output.textContent = "Hashing…";
  const lines = [];

  for (const file of files) {
    try {
      const bytes = await file.arrayBuffer();
      const digest = await crypto.subtle.digest("SHA-256", bytes);
      lines.push(`${file.name}: ${toHex(digest)}`);
    } catch (error) {
      const message = error instanceof Error ? error.message : String(error);
      lines.push(`${file.name}: could not hash file (${message})`);
    }
  }

  output.textContent = lines.join("n");
});

Know the browser and file-size limits

Secure context requirement

Web Crypto is exposed in secure contexts, normally HTTPS for a deployed site. Availability can also depend on browser and context, so check the compatibility information for the browsers you intend to support rather than assuming every browser/version behaves identically. The MDN digest() reference documents secure-context and worker availability.

The entire file must fit in memory

digest() is not a streaming API. MDN states: “Note that this API does not support streaming input: you must read the entire input into memory before passing it into the digest function.” The call to file.arrayBuffer() therefore loads the complete file before hashing. Very large files can consume substantial memory or fail; this simple implementation is not a suitable streaming solution. A worker can move computation away from the main thread, but it does not remove the full-input memory requirement. For large-file workflows, use a vetted streaming-capable implementation and assess its security and compatibility rather than splitting the file into chunks and hashing each chunk independently: that produces different values from the standard whole-file SHA-256 digest.

Remote URLs are different from user-selected files

This example hashes a local file chosen through the file picker. Fetching a file from a remote URL adds cross-origin restrictions: the remote server must permit the page to read it through CORS. MDN explains the distinction in its file-hashing example.

Use this as a checksum tool, not a complete security system

The example computes and compares a cryptographic digest; it does not authenticate a download, encrypt data, or protect a compromised website. MDN describes SubtleCrypto as a low-level interface whose cryptographic primitives can be misused. Keep the reference checksum separate from the file’s delivery path when you need meaningful verification, and use a broader, reviewed security design for applications where authenticity is critical. See MDN’s SubtleCrypto overview.

Quick Recap

SaleBestseller No. 1

TSUBOSAN Japan-Hardness Tester Checker File HRC40-HRC65 Set of 6

Item Category: Hardware Handle; Item Trademark: TSUBOSAN; Manufacturer: TSUBOSAN FILE CO;, Ltd

$69.96

Bestseller No. 2

4pcs Self Adhesive Acrylic Hinges, Folding Furniture Hardware

$14.15

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.