Hashes are computed locally with crypto.subtle.digest — nothing is uploaded. Note: MD5 isn't offered because the Web Crypto API doesn't support it (it's considered cryptographically broken).