Hash & Checksum
Check that the thing you downloaded is the thing they published. Drop the file in, paste the checksum from their page, and get told whether it matches — rather than squinting at sixty-four characters and deciding they look about right.
Hashed as UTF-8, with no trailing newline added — which is where a mismatch against a command-line result usually comes from.
The file does not go anywhere. It is read from disc by this page, in slices, and hashed as it is read. Nothing is uploaded — a checksum tool that sent the file to a server would be a strange thing to trust with an installer.
Large files are fine. Slices of four megabytes at a time, so a disc image is checked without ever being in memory at once.
On MD5. It is here because download pages still publish it, and for catching a truncated download it is fine. It is not fine for anything where somebody might want two files to have the same checksum: collisions have been practical for two decades. If the page offers SHA-256, use that one.