SHA-1, SHA-256, SHA-384, SHA-512 and HMAC over text or a file, computed in your browser.
This runs entirely in your browser. Nothing you paste, type or drop here is sent anywhere — there is no server on the other end of it.
SHA-256, SHA-384, SHA-512 and SHA-1 digests, plus HMAC when you have a key, computed by the browser's own WebCrypto implementation rather than by JavaScript pretending to be a hash function. Hash text, or drop in a file to check it against a published checksum.
Deliberately absent. WebCrypto does not implement it, and shipping a hand-rolled MD5 would mean carrying a broken hash function around so that a page can help people keep using a broken hash function. Collisions in MD5 are cheap to produce; do not use it for anything that matters.
No. Hashing is one-way by design. What tools that claim otherwise actually do is look the digest up in a table of pre-computed common inputs — which works fine on 'password123' and not at all on anything with real entropy.
No. SHA-256 is built to be fast, which is exactly wrong for passwords — it makes brute-forcing fast too. Use a deliberately slow, salted algorithm designed for the job: bcrypt, scrypt or Argon2.
Because git object ids and plenty of older checksums still use it, so you sometimes need to compute one to compare against. It is labelled in the interface as legacy. Do not choose it for anything new.
No. The file is read into memory in your browser and hashed there. Nothing leaves the page, which is what makes it safe to check a checksum on a file you would not want to upload.