What a Cryptographic Digest Can—and Cannot—Prove

A digest is a fingerprint-like value, not a lock

A cryptographic digest maps input data to a fixed-size output. If two files produce the same digest with a suitable modern algorithm, that can help detect accidental changes when the expected digest is trusted. A digest does not encrypt the original data, and it cannot be decrypted to recover it.

An attacker who can replace both a file and its published digest can replace both consistently. Authenticity requires a trusted channel, a digital signature, or another authenticated mechanism.

Password storage is a different problem

Fast general-purpose hashes are designed to calculate quickly. That makes them unsuitable as the only password-storage mechanism because an attacker can test guesses rapidly. Password storage should use a purpose-built password hashing function with appropriate salts and work factors.

The digest utility calculates supported SHA digests for text through Web Crypto. It is for learning or appropriate checks, not password storage or a security review. Avoid including confidential input on a device you do not control.