SubtleCrypto: digest() method

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since January 2020.

Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.

Note: This feature is available in Web Workers.

The digest() method of the SubtleCrypto interface generates a digest of the given data, using the specified hash function. A digest is a short fixed-length value derived from some variable-length input. Cryptographic digests should exhibit collision-resistance, meaning that it's hard to come up with two different inputs that have the same digest value.

It takes as its arguments an identifier for the digest algorithm to use and the data to digest. It returns a Promise which will be fulfilled with the digest.

Note that this API does not support streaming input: you must read the entire input into memory before passing it into the digest function.

Syntax

js
digest(algorithm, data)

Parameters

algorithm

This may be a string or an object with a single property name that is a string. The string names the hash function to use. Supported values are:

  • "SHA-1" (but don't use this in cryptographic applications)
  • "SHA-256"
  • "SHA-384"
  • "SHA-512".
data

An ArrayBuffer, a TypedArray or a DataView object containing the data to be digested.

Return value

A Promise that fulfills with an ArrayBuffer containing the digest.

Supported algorithms

Digest algorithms, also known as hash functions, transform an arbitrarily large block of data into a fixed-size output, usually much shorter than the input. They have a variety of applications in cryptography.

Algorithm Output length (bits) Block size (bits) Specification
SHA-1 160 512 FIPS 180-4, section 6.1
SHA-256 256 512 FIPS 180-4, section 6.2
SHA-384 384 1024 FIPS 180-4, section 6.5
SHA-512 512 1024 FIPS 180-4, section 6.4

Warning: SHA-1 is now considered vulnerable and should not be used for cryptographic applications.

Note: If you are looking here for how to create a keyed-hash message authentication code (HMAC), you need to use the SubtleCrypto.sign() instead.

Examples

For more examples of using the digest() API, see Non-cryptographic uses of SubtleCrypto.

Basic example

This example encodes a message, then calculates its SHA-256 digest and logs the digest length:

js
const text =
  "An obscure body in the S-K System, your majesty. The inhabitants refer to it as the planet Earth.";

async function digestMessage(message) {
  const encoder = new TextEncoder();
  const data = encoder.encode(message);
  const hash = await window.crypto.subtle.digest("SHA-256", data);
  return hash;
}

digestMessage(text).then((digestBuffer) =>
  console.log(digestBuffer.byteLength),
);

Converting a digest to a hex string

The digest is returned as an ArrayBuffer, but for comparison and display digests are often represented as hex strings. This example calculates a digest, then converts the ArrayBuffer to a hex string:

js
const text =
  "An obscure body in the S-K System, your majesty. The inhabitants refer to it as the planet Earth.";

async function digestMessage(message) {
  const msgUint8 = new TextEncoder().encode(message); // encode as (utf-8) Uint8Array
  const hashBuffer = await window.crypto.subtle.digest("SHA-256", msgUint8); // hash the message
  const hashHex = new Uint8Array(hashBuffer).toHex(); // Convert ArrayBuffer to hex string.
  return hashHex;
}

digestMessage(text).then((digestHex) => console.log(digestHex));

The above example uses Uint8Array.toHex(), which became available in 2025. To support older browsers, the following alternative can be used instead:

js
const text =
  "An obscure body in the S-K System, your majesty. The inhabitants refer to it as the planet Earth.";

async function digestMessage(message) {
  const msgUint8 = new TextEncoder().encode(message); // encode as (utf-8) Uint8Array
  const hashBuffer = await window.crypto.subtle.digest("SHA-256", msgUint8); // hash the message
  if (Uint8Array.prototype.toHex) {
    // Use toHex if supported.
    return new Uint8Array(hashBuffer).toHex(); // Convert ArrayBuffer to hex string.
  }
  // If toHex() is not supported, fall back to an alternative implementation.
  const hashArray = Array.from(new Uint8Array(hashBuffer)); // convert buffer to byte array
  const hashHex = hashArray
    .map((b) => b.toString(16).padStart(2, "0"))
    .join(""); // convert bytes to hex string
  return hashHex;
}

digestMessage(text).then((digestHex) => console.log(digestHex));

Specifications

Specification
Web Cryptography Level 2
# SubtleCrypto-method-digest

Browser compatibility

desktop mobile server
Chrome
Edge
Firefox
Opera
Safari
Chrome Android
Firefox for Android
Opera Android
Safari on iOS
Samsung Internet
WebView Android
WebView on iOS
Bun
Deno
Node.js
digest
Chrome – Partial support
Chrome 37 – 40 (Release date: 2014-08-26)
footnote Partial support
footnote Before version 41, Chrome expected the algorithm parameter to be an object.
Chrome – Full support
Chrome 41 (Release date: 2015-03-03)
footnote Full support
Edge – Partial support
Edge 12 – 18 (Release date: 2015-07-29)
footnote Partial support
footnote Not supported: SHA-1.
Edge – Full support
Edge 79 (Release date: 2020-01-15)
footnote Full support
Firefox – Full support
Firefox 34 (Release date: 2014-12-01)
footnote Full support
Opera – Partial support
Opera 24 – 27 (Release date: 2014-09-02)
footnote Partial support
footnote Before version 28, Opera expected the algorithm parameter to be an object.
Opera – Full support
Opera 28 (Release date: 2015-03-10)
footnote Full support
Safari – Full support
Safari 7 (Release date: 2013-10-22)
footnote Full support
Chrome Android – Partial support
Chrome Android 37 – 40 (Release date: 2014-09-03)
footnote Partial support
footnote Before version 41, Chrome Android expected the algorithm parameter to be an object.
Chrome Android – Full support
Chrome Android 41 (Release date: 2015-03-11)
footnote Full support
Firefox for Android – Full support
Firefox for Android 34 (Release date: 2014-12-01)
footnote Full support
Opera Android – Partial support
Opera Android 24 – 27 (Release date: 2014-09-10)
footnote Partial support
footnote Before version 28, Opera Android expected the algorithm parameter to be an object.
Opera Android – Full support
Opera Android 28 (Release date: 2015-03-10)
footnote Full support
Safari on iOS – Full support
Safari on iOS 7 (Release date: 2013-09-18)
footnote Full support
Samsung Internet – Partial support
Samsung Internet 3 – 3.2 (Release date: 2015-04-10)
footnote Partial support
footnote Before version 4.0, Samsung Internet expected the algorithm parameter to be an object.
Samsung Internet – Full support
Samsung Internet 4 (Release date: 2016-03-11)
footnote Full support
WebView Android – Partial support
WebView Android 37 – 40 (Release date: 2014-09-03)
footnote Partial support
footnote Before version 41, WebView Android expected the algorithm parameter to be an object.
WebView Android – Full support
WebView Android 41 (Release date: 2015-03-11)
footnote Full support
WebView on iOS – Full support
WebView on iOS 7 (Release date: 2013-09-18)
footnote Full support
Bun – Full support
Bun 1 (Release date: 2023-09-08)
footnote Full support
Deno – Full support
Deno 1.11 (Release date: 2021-06-08)
footnote Full support
Node.js – Full support
Node.js 15 (Release date: 2020-10-20)
footnote Full support

Legend

Tip: you can click/tap on a cell for more information.

Full support
Full support
Partial support
Partial support
Has more compatibility info.

See also