🧭 Pro Tips & Gotchas

What the hash buttons give you

• MD5 is computed in-page by a local implementation; SHA-1/256/512 go through crypto.subtle.digest with a TextEncoder-encoded input. Nothing is transmitted.
• Because crypto.subtle is a secure-context-only API, the SHA buttons require https:// (or localhost). On plain HTTP they will throw while MD5 keeps working.
• Hashing the same string in two tabs and comparing is the intended use; results are case-normalised hex, so compare them as lowercase.

Hash gotchas

• MD5 is broken for collision resistance. It is fine for a checksum-of-convenience or a cache key; it is not fine for signatures, password storage, integrity against an attacker, or dedup where an adversary controls one input.
• The famous MD5 collision cost is trivial: chosen-prefix collisions are commodity-priced now. Never gate a trust decision on "the hashes match".
• Trailing whitespace and newlines change everything. A file ending in \n versus one without produces completely different digests, and echo "x" adds a newline that printf 'x' does not.
• Encoding is a silent input. UTF-8 bytes of café differ from Latin-1 bytes of the same string; if two systems disagree, hash the bytes, not the characters.
• Line endings count. A CRLF checkout from git versus an LF working copy gives different hashes for identical-looking text (core.autocrlf is the usual culprit).
• For passwords, skip all of these hash functions: use Argon2id, scrypt, or bcrypt with a per-user salt. Fast hashes are the vulnerability, not the feature.
• Language interop fails on the hex string, not the algorithm: some runtimes emit uppercase, some emit base64. Normalise before comparing CI artifacts to local builds.