Web Crypto Snippets — Free HTML CSS JS SHA Hashing & Token Generators

The browser ships a real cryptography implementation, and for hashing and random generation there is no reason to bundle a JavaScript library instead. These snippets call crypto.subtle.digest and crypto.getRandomValues directly, which means the output matches what shasum or Node's crypto module produce for the same input, byte for byte.

Everything runs client-side, which is the whole point: hashing a file or checking a secret should never involve sending it anywhere.

Real digests, not an approximation

crypto.subtle.digest implements the actual SHA algorithms specified by NIST — the same math a command-line shasum or Node's crypto module runs — so a hash computed by one of these snippets is byte-for-byte identical to the one any other correct implementation produces for the same input. That correctness is what makes the checksum-verification snippet trustworthy: comparing against a vendor's published SHA-256 is a real integrity check, not a demonstration.

Files, hashed without ever leaving the device

Reading a File object's arrayBuffer() and passing it straight to digest() hashes arbitrary file content entirely in memory, with nothing uploaded anywhere. That is a meaningfully different trust story than a server-side hashing tool, which necessarily receives the file first — for anything sensitive, computing the digest locally is strictly the safer default.

Random values that are actually unpredictable

crypto.getRandomValues draws from the operating system's cryptographically secure random number generator, unlike Math.random, which is a fast but predictable pseudo-random generator never intended for anything security-adjacent. The token and UUID generators in this tag use getRandomValues specifically because the moment a generated value is a secret — an invite token, an API key — predictability becomes an exploitable weakness rather than a cosmetic flaw.

Entropy over arbitrary composition rules

The password-strength snippets here score based on the real size of the character set used and the length of the string — actual entropy — rather than checking boxes like "contains a symbol." A long passphrase with no symbols at all can be stronger than a short password that satisfies every composition rule, and entropy-based scoring is what actually reflects that.