Algorithms

Every row is create(name).info(), computed in your browser from the same registry the CLI and the agent tools read. Sort by digest to see what's 20 bytes and what's 64. The security note behind each row is the library's own, cut to its first clause. Hover it for the rest.

Picking one

For a new design, SHA-256 or BLAKE3 and move on. BLAKE3 when speed matters and you control both ends, SHA-256 when anything else has to agree with you.

For compatibility, the page of the thing you're matching wins. Ethereum wants Keccak-256, not SHA3-256, and the two differ in one padding byte. A Bitcoin address wants HASH160 of the key's bytes, not of its hex. The XRP Ledger wants SHA-512Half, which isn't SHA-512/256. Algorand wants the other one. Getting any of those almost right gives you a digest that looks exactly like the correct one.

For checksums somebody else published, whatever they published, MD5 included. For your own tables and dedup, xxHash or FNV-1a. Never for anything an attacker gets to choose.

For a password digest you need to reproduce, scrypt, PBKDF2 or Argon2id with the exact salt and cost it was made with. Salted KDFs explains why the salt comes back. Keys from a secret that's already strong, a shared secret or a master key, come from HKDF instead. Got a U2FsdGVkX1 blob from openssl enc or CryptoJS? Its key and IV come from EVP_BytesToKey.