ToolPortaToolPortaFree online utilities
Developer Documentation
JavaScript
Updated September 18, 2026

Cryptographic Hashing in JavaScript (SHA-256)

Compute secure SHA-256 and SHA-512 cryptographic digests in modern JavaScript using the native Web Crypto API and Node.js crypto module.

Cryptographic hash functions transform arbitrary input data into a fixed-size, deterministic digest. In modern JavaScript applications, hashing is essential for verifying file checksums, generating API signatures, creating cache keys, and building distributed content identifiers.

Quick Start (Browser & Edge Runtimes)#

The standard Web Crypto API (crypto.subtle) is universally available across modern browsers, Cloudflare Workers, Deno, and Node.js 16+:

JavaScript
1async function sha256(message) {2  // 1. Encode text string to UTF-8 byte array3  const encoder = new TextEncoder();4  const data = encoder.encode(message);56  // 2. Compute SHA-256 digest buffer7  const hashBuffer = await crypto.subtle.digest("SHA-256", data);89  // 3. Convert ArrayBuffer to hexadecimal string10  const hashArray = Array.from(new Uint8Array(hashBuffer));11  const hexString = hashArray12    .map((b) => b.toString().padStart(, "0"))13    .join("");1415  return hexString;16}1718// Example usage19sha256("ToolPorta Secure Payload").then(console.log);20// Output: "ebaaafbb17fa16f0be7ab74c04e07c985bf0913468f82bb8d95627ee83a1a7f2"

Quick Start (Node.js Backend)#

In Node.js backend services, the built-in node:crypto module provides synchronous and streaming hashing with high throughput:

JavaScript
1import crypto from "node:crypto";23// Synchronous string hashing4const hash = crypto5  .createHash("sha256")6  .update("ToolPorta Secure Payload")7  .digest("hex");89console.log(hash);10// Output: "ebaaafbb17fa16f0be7ab74c04e07c985bf0913468f82bb8d95627ee83a1a7f2"

Supported Algorithms#

The Web Crypto API supports the SHA-2 family:

  • "SHA-256": 256-bit digest (64 hex characters) — standard for security and verification.
  • "SHA-384": 384-bit digest (96 hex characters).
  • "SHA-512": 512-bit digest (128 hex characters) — maximum collision resistance.

In Node.js crypto, MD5 and SHA-1 are also available for legacy compatibility and non-cryptographic checksums:

JavaScript
1import crypto from "node:crypto";23const md5Digest = crypto.createHash("md5").update("hello").digest("hex");4console.log("MD5:", md5Digest);

Hex vs Base64 Output#

Depending on your protocol requirements, you can format the output digest as hexadecimal or Base64:

JavaScript
1import crypto from "node:crypto";23const text = "Hello ToolPorta";45// Hex representation (64 characters)6const hexOutput = crypto.createHash("sha256").update(text).digest("hex");78// Base64 representation (44 characters, compact for HTTP headers)9const base64Output = crypto.createHash("sha256").update(text).digest("base64");1011console.log("Hex:", hexOutput);12console.log("Base64:", base64Output);

Hashing Streams & Large Files in Node.js#

To hash gigabyte-scale files without exhausting system memory, stream the data through a hash transform stream:

JavaScript
1import fs from "node:fs";2import crypto from "node:crypto";34function computeFileHash(filePath) {5  return new Promise((resolve, reject) => {6    const hash = crypto.createHash("sha256");7    const stream = fs.createReadStream(filePath);89    stream.on("data", (chunk) => hash.update(chunk));10    stream.on("end", () => resolve(hash.digest("hex")));11    stream.on("error", (err) => reject(err));12  });13}

Best Practices#

  1. Use SHA-256 as default: SHA-256 balances security and performance across all environments.
  2. Never use plain SHA for password storage: Always use specialized key derivation functions such as Argon2id, bcrypt, or PBKDF2 with salting and work factors.
  3. Handle UTF-8 encoding explicitly: In browsers, always use TextEncoder() to ensure multi-byte Unicode strings hash identically across platforms.

References#

Implement Hashing in other languages:

C#C#GOGoJAVAJavaPYPythonTSTypeScript