Hash any text with SHA-1, SHA-256, SHA-384 or SHA-512 using your browser's built-in Web Crypto implementation. All four are computed at once so you can compare, and because the work happens locally nothing you paste is transmitted.
A cryptographic hash maps any input to a fixed-length value such that finding two inputs with the same output is computationally infeasible, and the output reveals nothing about the input. That makes it good for verifying that a file or message arrived unaltered - change one bit of the input and roughly half the output bits flip.
A practical collision was demonstrated in 2017 and the cost has fallen sharply since. It is included here only for checking legacy checksums and Git object IDs. Do not use it for anything where an attacker benefits from a collision. SHA-256 is the sensible default.
SHA-256 is designed to be fast, which is exactly wrong for passwords: commodity hardware can try billions of candidates per second. Password storage needs a deliberately slow, memory-hard, salted algorithm - Argon2id, scrypt or bcrypt. Using a plain SHA hash for passwords is one of the most common serious mistakes in web applications.
The Web Crypto API does not implement MD5, deliberately. It has been comprehensively broken since 2004 and there is no remaining use for it that a better algorithm does not serve.
SHA-256 for general integrity checking. SHA-1 is broken for anything security-related - practical collisions were demonstrated in 2017 - and is included here only for verifying legacy checksums.
Not a plain one. Raw SHA-256 is far too fast, so an attacker can try billions of guesses per second. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
Because the Web Crypto API does not implement it, and deliberately so: MD5 has been comprehensively broken since 2004 and should not be used for anything.
Steuervergleich Kanton Zürich — Gemeindesteuern vergleichen (Deutsch)