Stress / 04

Hash throughput.

Repeatedly SHA-256 hashes a 1 MB buffer for four seconds and reports MB/s. Hardware SHA on modern CPUs hits 1-3 GB/s.

How it works

We generate a 1 MB random buffer once, then repeatedly call crypto.subtle.digest("SHA-256", buf) until 4 seconds have elapsed. The browser routes to hardware SHA where available (Intel SHA-NI, ARMv8 Crypto), otherwise to a software implementation.

Throughput is total bytes divided by wall-clock time. Hash count is reported too — sub-1000 hashes/sec on a desktop is a strong sign that hardware acceleration isn't engaged.

Related
CPU benchmark
Multi-threaded hashing across every logical core.
WebGPU compute
GPU-side compute throughput in GOps/s.
Capabilities
Check which other Web APIs are available.
Frequently asked

Why measure SHA-256 throughput?

SHA-256 is the workload behind HTTPS, code signing, file integrity, blockchain mining, and many compression pipelines. Modern CPUs include SHA-NI (Intel) or ARMv8 Crypto extensions — silicon that runs SHA 4-10× faster than a pure-software implementation. This test surfaces whether the acceleration is engaged.

What's a good number?

1500-3000 MB/s on a recent desktop CPU with hardware SHA. 500-1500 MB/s on most laptops. Under 300 MB/s typically means software-only SHA — either an older CPU (pre-Skylake / pre-ARMv8) or the browser engine isn't routing to the hardware path.

Why not also test AES?

We focus on SHA because it's the single most-run crypto primitive on a typical browsing session (HTTPS handshakes, certificate chains, JS file integrity hashes, IndexedDB checksums). AES throughput correlates with SHA throughput on modern silicon, so SHA is the cheaper signal.

Does SubtleCrypto block the main thread?

No — it returns a Promise and runs the hash on a background thread (browser-internal). That's why this benchmark doesn't block your scrolling. CPU.subtle.digest is one of the few JS APIs that's genuinely parallel without you having to manage workers.

Should I worry if my numbers are low?

Only if you're CPU-bound on a hash-heavy workload (file-system indexing, big code-sign verification, mining). For casual browsing, sub-1 GB/s SHA is irrelevant. For workloads where it matters: a faster CPU with hardware SHA is the only fix.

Related tools in Stress
CPU benchmark
Multi-thread hash workload.
WebGL benchmark
Triangle throughput, shader complexity.
WebGPU compute
Compute-shader throughput in GOps/s.
Memory pressure
Allocation ceiling probe.
Thermal reveal
Back-to-back CPU bench detects throttling.