FAQ

Does Rosehip upload my file?

No. The page has no upload endpoint and no server-side code. A file is read through a local file handle, hashed in the tab and forgotten when the page is closed. You can confirm this in your browser's developer tools: no request is made while a digest is computed.

Can I hash a very large file?

Yes. Files above 256 MB are streamed in 8 MB chunks, so memory use stays flat. The cost is time: a pure-JavaScript SHA-256 processes tens of megabytes per second, so a multi-gigabyte file takes minutes. Keep the tab in the foreground; the browser may throttle background tabs.

Why do two files that look identical have different digests?

Because they are not identical. Differences that never show in an editor still count: CRLF versus LF line endings, a byte-order mark, trailing whitespace, an embedded timestamp or a different character encoding. Compare with a hex viewer or cmp when the digests disagree but the text looks the same.

Why only SHA-256, and not MD5 or SHA-1?

Because SHA-256 is the one digest contemporary release pages publish. MD5 and SHA-1 both have practical collisions and are unsuitable for integrity decisions, so offering them would suggest a check that is weaker than it looks. If you need SHA-512 or BLAKE3, use a dedicated tool.

Does a matching checksum mean the file is safe?

No. It means the bytes match the digest you compared against. It says nothing about the author, the distributor, or the safety of what runs. Signatures answer a different question; a checksum cannot replace them.

Does it work offline?

Nothing is guaranteed. The page must be loaded once over the network; after that, hashing and the text tools do not need a connection, and the browser's cache may let you reopen it offline. There is no service worker, so treat offline use as a convenience rather than a feature.

What is logged when I visit?

There are no cookies, no analytics and no third-party requests. The web server keeps ordinary access logs — IP address, time, requested path, user agent — as any HTTP server does. File contents, pasted text and computed digests are never part of a request, so they cannot appear in those logs.

Can I paste a secret into the tools?

The panels work locally and do not transmit their contents, but the safe habit is to avoid pasting live credentials into any web page. If you must, load the page first, then disconnect the network before pasting; the tools keep working.

Why did my JSON keys change order?

Formatting parses and re-serialises the document. JavaScript keeps string keys in insertion order but moves integer-like keys to the front, in ascending order. If order matters, encode the data as an array of pairs instead of a bare object.

Why is the digest lowercase when the publisher's is uppercase?

Hex case is cosmetic. Rosehip prints lowercase and the expected-value field ignores case, spaces and a leading sha256:, so either form compares correctly.

Is there source code I can read?

The site is a single HTML document, one stylesheet and one JavaScript file, served as static files. You can read all of it with your browser's view-source and developer tools; there is no build step and no minification to reverse.

Something looks wrong. Where do I report it?

There is no public issue tracker yet, so this page does not pretend otherwise. If you reached Rosehip through someone who operates it, tell them which tool, which input and which browser version you used; that is enough to reproduce most problems.