Hash any text with SHA-1, SHA-256, SHA-384 or SHA-512 using your browser's built-in Web Crypto implementation. All four are computed at once so you can compare, and because the work happens locally nothing you paste is transmitted.
SHA-256 for general integrity checking. SHA-1 is broken for anything security-related - practical collisions were demonstrated in 2017 - and is included here only for verifying legacy checksums.
Not a plain one. Raw SHA-256 is far too fast, so an attacker can try billions of guesses per second. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
Because the Web Crypto API does not implement it, and deliberately so: MD5 has been comprehensively broken since 2004 and should not be used for anything.