What Hashing Does
A hash function turns input data into a fixed-length fingerprint. The same input always produces the same output, while a tiny change produces a completely different result. Hashes are used for checksums, cache keys, data integrity checks, content identifiers and many developer workflows. Good hash functions are fast to compute and infeasible to invert.
MD5 and SHA-1
MD5 produces a 128-bit digest and SHA-1 produces a 160-bit digest. Both are fast and widely supported, and both are still found in legacy systems. However, practical collision attacks exist against MD5 and SHA-1, so they are not suitable for signatures, certificates or security-sensitive integrity checks.
MD5 is sometimes still used for non-security checksums, such as detecting accidental file changes or generating cache keys. That use is acceptable only when collisions are not a security concern.
SHA-256 and SHA-512
The SHA-2 family includes SHA-256 and SHA-512, with 256-bit and 512-bit digests. They are strong general-purpose choices for integrity and security. SHA-256 is the most common default in modern systems; SHA-512 is useful when a larger digest is required or when the platform performs better with 64-bit operations.
Which Should You Use?
| Use case | Recommendation |
|---|---|
| New integrity or security work | SHA-256 or SHA-512 |
| Legacy checksum compatibility | MD5/SHA-1 only if required |
| Password storage | Dedicated password hashing, not MD5/SHA-256 |
| Cache key or content identifier | SHA-256 or a stable non-cryptographic hash |
Hashing Is Not Encryption
Hashing is one-way. You cannot recover the original input from a hash. Encryption is reversible with the right key. If you need confidentiality, use encryption and key management. If you need to verify authenticity, use a keyed MAC or a digital signature, not a bare hash.
Do Not Use Fast Hashes for Passwords
MD5, SHA-1 and SHA-256 are designed to be fast. Fast hashes make brute-force and dictionary attacks cheaper. Password storage should use a dedicated password hashing algorithm such as Argon2, bcrypt or scrypt, with a unique salt and an appropriate work factor.
Why Identical-Looking Strings Differ
Hashes operate on bytes. Trailing spaces, different line endings, hidden Unicode characters, different encodings and case changes all produce different hashes. If two values look identical but hash differently, compare them byte by byte, normalize line endings and check for invisible characters.
This is also why hashing a value after normalizing it can be useful for comparisons, but normalization must be intentional and consistent.
Collision Resistance
A collision occurs when two different inputs produce the same hash. MD5 and SHA-1 have practical collision attacks, which is why they are unsuitable for signatures, certificates and security decisions. SHA-256 and SHA-512 are designed to resist known collision attacks. Collision resistance matters when an attacker could benefit from substituting one value for another.
Hashing Large Inputs
Hash functions can process data incrementally, which is how large files are hashed without loading everything into memory. The final digest is the same whether the input is processed in one pass or many. This tool focuses on text input; for large files, use a dedicated file checksum utility and compare the resulting digest with the published value.
Checksums in Practice
When publishing a file, a checksum lets users verify that the download matches the original. Use SHA-256 for new releases and keep MD5 only for legacy compatibility. Compare digests exactly: a single character difference means the data is different. A checksum detects accidental corruption; it does not prove who published the file. For authenticity, use a signature. Publish the algorithm name and the digest together so users know exactly what to compare. Use constant-time comparison when a hash is used as a secret; for public checksums, a normal comparison is fine. This is standard practice for release files.
A Practical Workflow
- Paste the text into the Hash Generator.
- Choose MD5, SHA-1, SHA-256, SHA-384 or SHA-512.
- Choose hexadecimal or Base64 output.
- Copy or download the result.
For reversible encoding, use the Base64 Encoder / Decoder. For unique identifiers, use the UUID Generator. To inspect token claims, use the JWT Decoder.