How to Hash a File in JavaScript: SHA-256, MD5, and SHA-1

Calculating cryptographic hashes of files is fundamental for data deduplication, tamper verification, and integrity checks. Modern browsers provide the high-performance Web Crypto API for SHA-256 and SHA-512, while Node.js offers the native crypto module with streaming support.

Web Crypto API (Browser SHA-256)

The Web Crypto API runs inside the browser engine using hardware-accelerated cryptographic primitives:

export async function calculateFileSha256(file: File): Promise<string> {
  const arrayBuffer = await file.arrayBuffer();
  const hashBuffer = await crypto.subtle.digest('SHA-256', arrayBuffer);

  // Convert ArrayBuffer to Hex string
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  const hexHash = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');

  return hexHash;
}

Streaming Hashes in Node.js (Large Files)

When hashing multi-gigabyte files in Node.js, loading the entire file into memory with fs.readFileSync causes out-of-memory crashes. Use streaming transforms instead:

import fs from 'fs';
import crypto from 'crypto';

export function getFileChecksum(filePath: string, algorithm = 'sha256'): Promise<string> {
  return new Promise((resolve, reject) => {
    const hash = crypto.createHash(algorithm);
    const stream = fs.createReadStream(filePath);

    stream.on('data', (chunk) => hash.update(chunk));
    stream.on('end', () => resolve(hash.digest('hex')));
    stream.on('error', (err) => reject(err));
  });
}

When to Use MD5 vs SHA-256

• MD5: Cryptographically broken. Do not use for password hashing, digital signatures, or security checks. Still widely used for non-security checksums, such as AWS S3 ETag verification and local file caching keys.
• SHA-256: Strong cryptographic collision resistance. The industry benchmark for software releases, package integrity, and blockchain transactions.