Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.
See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)