When to use it
Verifying a downloaded file's integrity, deriving cache keys, building short identifiers — anything where "same input → same output" is the guarantee you need.
Picking an algorithm
- MD5 — fast but broken for security. Still fine for non-adversarial integrity checks.
- SHA-1 — used by Git and some legacy certificates. Avoid for new signing work; collisions have been demonstrated.
- SHA-256 — the most common default for checksums and digital signatures. For password storage prefer a dedicated function like bcrypt or argon2 over plain SHA.
- SHA-512 — larger digest. Useful for big data sets.
hex vs base64
The same digest, two encodings. hex is the human-readable standard for fingerprint comparisons. base64 is shorter (SHA-256 is 64 hex chars vs 44 base64 chars) and friendlier in URLs and API tokens.
Where does your input go?
Hashes are computed via the Web Crypto API and a built-in MD5 implementation in your browser. Your text is never uploaded or stored. Close the tab and it's gone.