Hash generator

What you type is encoded to UTF-8 with TextEncoder and those bytes are hashed — the byte count next to the input is that encoding, not the character count. A textarea turns every line break into LF, so text pasted with CRLF endings hashes as LF text, and a lone surrogate becomes U+FFFD before hashing. "Trim whitespace" drops leading and trailing whitespace before encoding, which changes the digest; "Uppercase hex", on by default, only changes the display, capitalising the hex digits and leaving the CRC-32 0x prefix as it is. SHA-1, SHA-256, SHA-384 and SHA-512 come from crypto.subtle.digest, the browser's own code. WebCrypto has no MD5 and no CRC-32, so both are written out in plain JavaScript in this page — MD5 is RFC 1321, CRC-32 is the reflected IEEE 802.3 polynomial used by zip and PNG.

MD5 and SHA-1 are broken for collision resistance: two different inputs with the same digest are cheap to produce, so neither says anything about who made a file. They are here to check legacy values, nothing more. CRC-32 is error detection — it catches a flipped bit in transit and is trivial to forge on purpose. MySQL PASSWORD() is SHA-1 applied twice over the raw bytes with a leading asterisk, the old mysql_native_password format; it is printed in capitals because the format is. MySQL 8 defaults to caching_sha2_password, which is salted and iterated, so it cannot be reproduced from the password alone and this tool does not try.

None of these are password hashes in the modern sense. To store real passwords use argon2, scrypt or bcrypt, which are deliberately slow. What this tool refuses to do: it does not hash files — only the text in the box — and it does no HMAC, no salt, no key derivation and no iteration count. Input above 5,000,000 characters is refused rather than attempted, and the limit is printed when you hit it. Above 200,000 characters MD5 and CRC-32 run one frame late, after the page has repainted, so the tab keeps answering while they work. crypto.subtle needs a secure context: opened over https, from localhost or straight from disk (file://) it works; over plain http from any other host the browser withholds it. When it is missing the SHA and MySQL rows say why; when a digest call fails they print the browser's own error. MD5 and CRC-32 run either way. Nothing is uploaded: there is no server in this file.

The Dark button remembers its setting in this browser's local storage. Nothing you type or drop into the page is stored.