Hash Generator
Enter text to generate MD5, SHA-1, SHA-256, and SHA-512 hashes in real time.
Type or paste any text to see its MD5, SHA-1, SHA-256, and SHA-512 hashes update in real time.
About Hash Functions
A hash function takes an input of any size and produces a fixed-length string of characters known as a digest or checksum. Hash functions are deterministic — the same input always produces the same output — and even a single-character change in the input produces a completely different hash. This property makes them invaluable for verifying data integrity.
Key Properties of Cryptographic Hash Functions
Cryptographic hash functions have three essential properties. First, they are one-way: given a hash output, it is computationally infeasible to reconstruct the original input. Second, they are collision-resistant: it should be extremely difficult to find two different inputs that produce the same hash. Third, they exhibit the avalanche effect: changing a single bit in the input flips roughly half the bits in the output, making the two hashes appear completely unrelated.
Comparing MD5, SHA-1, SHA-256, and SHA-512
MD5 produces a 128-bit (32-character hex) digest. It is fast but cryptographically broken — researchers have demonstrated practical collision attacks, so it should not be used for security purposes. It remains useful for non-security checksums like verifying file downloads.
SHA-1 produces a 160-bit (40-character hex) digest. Like MD5, SHA-1 has known collision vulnerabilities and has been deprecated by most security standards. Google demonstrated a practical SHA-1 collision in 2017.
SHA-256 and SHA-512 are members of the SHA-2 family. SHA-256 produces a 256-bit (64-character hex) digest and is the most widely used algorithm for security applications today, including TLS certificates, Bitcoin mining, and software signing. SHA-512 produces a 512-bit (128-character hex) digest and can be faster than SHA-256 on 64-bit processors.
Common Use Cases
File integrity verification: Software distributors publish SHA-256 checksums alongside downloads so users can confirm files were not tampered with during transit. Password storage: Instead of storing passwords in plain text, applications store their hashes. When a user logs in, the application hashes the submitted password and compares it to the stored hash. Modern password hashing uses specialized algorithms like bcrypt or Argon2 that add salting and deliberate slowness to resist brute-force attacks. Digital signatures: Hash functions are a core building block of digital signature schemes, where the hash of a message is signed with a private key to prove authenticity.
Hashing vs Encryption
Hashing and encryption are fundamentally different. Encryption is reversible — data encrypted with a key can be decrypted with the corresponding key. Hashing is a one-way operation with no key and no way to recover the original input from the hash. Use encryption when you need to retrieve the original data later; use hashing when you only need to verify that data matches an expected value.
Frequently Asked Questions
What is the difference between MD5 and SHA-256?
MD5 produces a 128-bit (32-character hex) hash and is fast but cryptographically broken — practical collision attacks exist. SHA-256 produces a 256-bit (64-character hex) hash and remains secure against all known attacks. Use SHA-256 for any security-related purpose and MD5 only for non-security checksums like verifying file downloads.
Can you reverse a hash back to the original text?
No, cryptographic hash functions are one-way operations by design. Given a hash output, it is computationally infeasible to reconstruct the original input. Attackers use precomputed lookup tables (rainbow tables) or brute-force guessing, but this is not the same as reversing the hash. Salting inputs makes these attacks much harder.
Is MD5 still safe to use?
For non-security purposes like file checksums and cache keys, MD5 is still practical and fast. For any security application — password hashing, digital signatures, certificate verification — MD5 is broken and should not be used. Researchers demonstrated practical collision attacks years ago, so use SHA-256 or better for security needs.
What is a hash collision?
A hash collision occurs when two different inputs produce the same hash output. Since hash functions map an infinite input space to a fixed-size output, collisions must theoretically exist. A secure hash algorithm makes finding collisions computationally infeasible, requiring more effort than brute-force search across the entire output space.
Which hash algorithm should I use?
Use SHA-256 for security applications including digital signatures, certificate verification, and data integrity in adversarial contexts. For non-security checksums like deduplication or cache keys, MD5 is fine and faster. For password hashing specifically, use dedicated algorithms like bcrypt or Argon2 that add salting and deliberate slowness.