About hash functions

MD5

128-bit hash. Fast but cryptographically broken — use only for checksums, not security.

SHA-1

160-bit hash. Deprecated for security use. Still found in legacy systems and Git.

SHA-256 / SHA-512

Current standards. SHA-256 used in Bitcoin, TLS, JWT. SHA-512 provides stronger collision resistance.

How to Use the Hash Generator

Enter your input text — paste any text, password, file content, or string you want to hash.
Select hash algorithm — MD5 for legacy compatibility, SHA-1 for checksums, SHA-256 for security, SHA-512 for maximum security.
Read the hash output — the hash is displayed as a hexadecimal string. Even a single character change in input produces a completely different hash.
Verify data integrity — hash a file or string, then hash it again later. Identical hashes confirm the data has not changed.
Compare hashes — paste two hashes to check if they match, useful for verifying downloaded files against published checksums.

🔒 One-way only: Hash functions are one-directional — you can hash data, but you cannot reverse a hash back to the original input. This is by design. If someone claims to 'decrypt' an MD5 hash, they are using a pre-computed lookup table (rainbow table), not reversing the hash mathematically.

Understanding Cryptographic Hash Functions

🔢 What Is a Hash?

A fixed-length output produced by running input data through a mathematical function. SHA-256 always produces a 256-bit (64 hex character) output regardless of input size. 'hello' and a 10GB file both produce 64-character SHA-256 hashes. The same input always produces the same output.

🎯 Key Properties

Deterministic: same input → same hash always. Fast to compute. One-way: cannot reverse hash to input. Avalanche effect: changing one bit of input changes approximately 50% of output bits. Collision resistant: practically impossible to find two different inputs with the same hash.

📊 Algorithm Comparison

MD5: 128-bit, fast, BROKEN — collisions found, do not use for security. SHA-1: 160-bit, broken for security purposes. SHA-256: 256-bit, current standard for most security uses. SHA-512: 512-bit, slower but higher security margin. SHA-3: newest standard, different mathematical approach.

✅ File Integrity Verification

Download a file, then compare its SHA-256 hash against the hash published on the official website. If they match, the file is authentic and unmodified. If they differ, the file was corrupted during download or is a malicious substitute. Linux/Mac: `sha256sum filename`. Windows: `Get-FileHash filename`.

🔐 Password Hashing

Never store plain text passwords. Hash them with a password-specific algorithm: bcrypt, Argon2, or scrypt. These are intentionally slow (preventing brute force) and include a salt (preventing rainbow table attacks). Do NOT use MD5 or SHA for passwords — they are too fast and vulnerable to brute force attacks.

🔏 HMAC

Hash-based Message Authentication Code — combines a hash with a secret key to verify both data integrity AND authenticity. HMAC-SHA256 ensures the message was not modified AND was sent by someone with the secret key. Used in API authentication, JWT signing, and webhook verification.

Hash Functions in Development

API request signing

Many APIs require request signing using HMAC — hashing the request body with a shared secret key. The sender computes HMAC-SHA256(request_body, secret_key) and includes it in the request header. The server recomputes the same HMAC and compares — if they match, the request is authentic and unmodified. This prevents both tampering and replay attacks. AWS Signature Version 4, Stripe webhook verification, and most modern API authentication systems use this pattern.

Content addressing and caching

Content-Addressable Storage (CAS) uses hashes as file identifiers. Git stores every file and commit as its SHA-1 hash. Docker uses SHA-256 hashes for image layers. This approach guarantees: identical content has identical address (perfect deduplication), any modification produces a new address (perfect cache invalidation), and the address itself verifies integrity. The hash IS the content identity.

Data deduplication

Hashing enables efficient deduplication: hash each file, store the hash in a database, check before storing new files. If the hash already exists, the file is a duplicate — reference the existing copy instead of storing another. Dropbox, Google Drive, and cloud backup services use this approach to massively reduce storage requirements. A 10GB video uploaded by 1,000 users is stored once, referenced 1,000 times.

🔒 Algorithm selection guide: Password storage: Argon2id or bcrypt (never MD5/SHA). File integrity: SHA-256. Digital signatures: SHA-256 or SHA-3. API request signing: HMAC-SHA256. Checksums for non-security uses: MD5 (fast, sufficient for error detection). Blockchain/cryptocurrency: SHA-256. Git commits: SHA-1 (being migrated to SHA-256). When in doubt: SHA-256.

Frequently Asked Questions

MD5, SHA-1, SHA-256, SHA-512 — what's the difference?

They differ in output size and security. MD5: 128-bit (32 hex chars). SHA-1: 160-bit (40). SHA-256: 256-bit (64). SHA-512: 512-bit (128). Larger = harder to crack. MD5 and SHA-1 are cryptographically broken.

Which hash should I use?

For security: SHA-256 or SHA-512. For checksums: MD5 or SHA-256. For password storage: use bcrypt, scrypt, or Argon2 — never plain SHA hashes.

Can I reverse a hash?

Hash functions are one-way by design — there is no mathematical algorithm to reverse them. Common inputs can be looked up in precomputed rainbow tables, which is why password hashing uses salts.