A hash function takes any text or file and produces a fixed-length fingerprint — MD5 is 128 bits, SHA-1 is 160 bits, and the SHA-2 family (SHA-256/384/512) runs from 256 to 512 bits. The same input always produces the same output, but you can't reverse the process to get the input back, which is exactly what makes hashes useful for verifying that a file wasn't altered or for comparing two pieces of data without exposing the data itself. HMAC adds a secret key into that process so the resulting digest also proves who created it, not just that the content matches.
They're broken for security purposes like password storage or digital signatures, because researchers can craft two different inputs that hash to the same value (a collision). They're still perfectly fine for non-adversarial uses like checking a downloaded file wasn't corrupted, which is why they're kept alongside SHA-256/512.
A plain hash only proves data integrity — anyone can compute it. HMAC mixes a secret key into the hashing process, so only someone who knows that key can generate or verify the correct digest, which is what APIs use to authenticate webhook payloads and signed requests.
No. All hashing runs using your browser's built-in cryptography, so nothing you type or upload is transmitted anywhere — the digest is computed and shown to you locally.