Calculating file checksums locally with FileReader and Blob.slice

File.slice windows

const chunk = file.slice(offset, offset + size). arrayBuffer each chunk. 1–4 MB balances I/O and GC. Sequential, not random, for disk cache. This is the same primitive as the Blob API article.

Incremental APIs

hash-wasm createSHA256(), update(Uint8Array), digest(). Workers so the page stays clickable. Cancel by ignoring further chunks. The file hash calculator is this loop with algorithm checkboxes.

Progress

offset / file.size. Do not use a fake spinner with a hidden upload. The Network tab should stay quiet — audit it.

Compare to shasum

Same lowercase hex. Windows certutil is a different default encoding sometimes. Document the algorithm in the filename. Small files can use one-shot SHA-256 without slicing.

Base64 detour

Do not hash a data URL string if you meant the binary. Hash the Blob. Base64 memory is how people accidentally checksum the wrong representation.

Why not cloud scanners by default

Uploading binaries to reputation services is a choice for public malware, not NDAs. Hash locally, then decide. HMAC is when you also have a key; checksums are unkeyed integrity.

Worked example: checksum a 700 MB installer

Do not file.arrayBuffer() the whole thing. Open file hash calculator, pick SHA-256, watch progress. Under the hood: File.slice 2 MB windows into hash-wasm update(). Compare the lowercase hex to the vendor’s published sum. If they published MD5 only, you may still run MD5 for compatibility and SHA-256 for yourself.

SRI is not this use case. SRI is a script or stylesheet the browser will load; encoding is base64. SRI generator on a 700 MB file is the wrong tool. Small npm bundles: SRI article. Large binaries: this article.

While hashing, Network should be idle of uploads (audit). A “virus scan online” that asks for the file is a sample-collection pipeline. Hash locally, then if you still want reputation, send the hex, not the bytes.

Workers: keep the hasher off the UI thread so Cancel works. Revoke any object URLs you created for a progress UI. Blob.slice is the only File API you need; do not Base64 the installer first.

Frequently asked questions