Record exactly what a set of files was, down to the byte, and check later that it still is. Hand the record to the other side with the files and they can confirm for themselves that what they received is what you sent. Verifying needs the same pass, so hand the manifest to someone who holds one, or keep the record for your own file. Nothing is uploaded and no hash leaves this tab.
No files chosen yet. Nothing is uploaded; every hash is computed here.
It proves the bytes are identical. Change one character in one file and its SHA-256 digest changes completely. Two sets with the same manifest digest contain the same files, byte for byte. That part is solid, and there is no practical way to make two different files share a SHA-256 digest.
It does not prove when. The date on this record comes from the clock of the machine that made it, and that machine is yours. A manifest is your own record, not independent evidence of timing. If the timing matters, get the digest in front of somebody else who will date its arrival: email it, file it, register it. That is one message, and it turns your assertion into something a third party can speak to.
It does not prove who. Anyone holding the files can make a manifest, including someone who altered them first. A record shows that a set changed between two points; it does not say who changed it. Used properly, that is still the whole game: make the record at the moment you receive or send, and the gap where tampering could happen closes.
File names are part of the record. Renaming a file shows up as one missing and one unexpected, not as a match. That is deliberate. If you reorganise a bundle, record it again and keep both records.
Large files are handled properly. Anything over 64 MB is read in slices and hashed as it goes, so a multi-gigabyte video does not have to fit in memory. The page checks its own arithmetic against the browser’s built-in implementation on load and says so if the two ever disagree.
Nothing is uploaded. Your files are read in this tab and never leave it. Neither do the hashes. If you close the page, nothing about your files remains anywhere but in the manifest you chose to download.