Why no MD5?
MD5 and SHA-1 are both considered cryptographically broken for security purposes (collisions can be deliberately engineered), though SHA-1 is still included here since it's often needed for compatibility with older systems. MD5 isn't offered because browsers' built-in Web Crypto API doesn't support it at all — for anything security-sensitive, use SHA-256 or SHA-512.