Why check a file's checksum
Software publishers list a checksum, a short fingerprint of the file, next to their downloads. If the file you downloaded produces the same checksum, it is exactly the file they published and wasn't corrupted or swapped along the way.
How it works
Your browser reads the file in chunks and computes SHA-256, SHA-1 and MD5 locally. The file is never uploaded, so it works for large files and private documents alike.
Questions
Which hash should I compare?
Use SHA-256 when the publisher offers it. MD5 and SHA-1 are fine for catching corruption but not for detecting deliberate tampering.
Is there a size limit?
No fixed limit. Very large files take longer, depending on your device.