What a hash function does
A cryptographic hash turns any amount of input into a fixed-length fingerprint. MD5 always produces 128 bits (32 hex characters), SHA-1 produces 160 bits (40 characters), SHA-256 produces 256 bits (64 characters) and SHA-512 produces 512 bits (128 characters). The same input always gives the same digest, and changing a single bit changes roughly half the output bits, which is why hashes are used to detect accidental corruption in downloads, to key a cache, to deduplicate files, and to build Git object IDs and blockchain blocks.
The input here is treated as UTF-8 bytes, which is what almost every command-line tool assumes. That matters: an accented letter or an emoji is more than one byte, so the digest of a string with non-ASCII characters only matches a shell command if that command also reads UTF-8. A trailing newline changes the digest too, which is the single most common reason a hash computed in a browser does not match one computed with echo text | md5sum - echo adds a newline unless you pass -n.
How this page computes them
MD5 is implemented in plain JavaScript on this page, following RFC 1321: the message is padded, split into 512-bit blocks, and mixed through 64 rounds with sine-derived constants. SHA-1, SHA-256 and SHA-512 come from the Web Crypto API (crypto.subtle.digest), which is built into every current browser and is implemented in native code, so it is fast even on multi-megabyte inputs. Web Crypto is only exposed on secure pages, so if you open this file over plain http the SHA rows will say the algorithm is unavailable while MD5 still works.
Web Crypto is asynchronous, so the MD5 value appears immediately and the SHA rows fill in a few milliseconds later. Nothing is uploaded - there are no network requests on this page, so it is safe to hash file contents, API responses or internal identifiers. As a check, md5("hello") is 5d41402abc4b2a76b9719d911017c592 and sha256("hello") starts with 2cf24dba5fb0a30e.
Which algorithm to pick
Use MD5 or SHA-1 only where collisions do not matter: verifying that a download was not truncated, generating cache keys, or comparing two local files. Both are cryptographically broken - researchers can create two different inputs with the same MD5 digest in seconds, and the SHAttered attack did the same for SHA-1 in 2017 - so neither should protect a signature, certificate or integrity check against a determined attacker. NIST disallowed SHA-1 for digital signatures in federal use and is retiring it entirely.
For anything security-related use SHA-256, or SHA-512 when you are on 64-bit hardware and want extra margin. For passwords, a plain hash of any kind is the wrong tool: raw SHA-256 can be guessed billions of times per second on a GPU. Use a deliberately slow, salted password hash such as bcrypt, scrypt or Argon2id instead. And a hash is not encryption - it cannot be reversed, but short or predictable inputs are trivially found in rainbow tables, so never publish the hash of something you want to keep secret.