Questions About This Tool
Why does my digest not match sha256sum?
Almost always a trailing newline. Echoing text on a shell adds one unless you use echo -n, and a file usually ends with one. The bytes differ, so the digests differ.
Can a hash be reversed?
No. A digest is a fixed-length fingerprint and the original text is not recoverable from it. What is possible is guessing: hashing likely inputs and comparing, which is why hashing is not a way to hide small or predictable values.
Should I use this to store passwords?
No. Use bcrypt, scrypt, or Argon2, which are salted and deliberately slow. SHA-256 is fast by design, and that speed is exactly what helps an attacker working through a stolen table.
Is SHA-1 safe to use?
Not for anything security-relevant. Practical collisions were demonstrated in 2017. It remains useful for legacy checksums and for reading Git object ids, which is why it is offered here with that warning attached.
Where is MD5?
The browser’s Web Crypto API does not implement it, and this tool uses only the browser’s own cryptography rather than hand-written code. For a legacy MD5 checksum, use md5sum or certutil locally.