A hash function takes any input — a word, a file, a document — and produces a fixed-length string called a hash or digest. The same input always produces the same hash; any change to the input (even one character) produces a completely different hash. This one-way, deterministic property makes hashes useful for verifying integrity, not for securing data.
The Three Common Hash Algorithms
MD5
- Output: 128-bit (32 hex characters)
- Example:
MD5("hello") = 5d41402abc4b2a76b9719d911017c592 - Status: Do not use for security. MD5 has known collision vulnerabilities (different inputs producing the same hash). It's still used for basic file integrity checks where security isn't the concern.
SHA-1
- Output: 160-bit (40 hex characters)
- Example:
SHA-1("hello") = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d - Status: Do not use for security. Google demonstrated practical SHA-1 collisions in 2017. Deprecated by major standards bodies.
SHA-256
- Output: 256-bit (64 hex characters)
- Example:
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 - Status: The current standard. No practical collisions known. Use this for any security-relevant purpose.
Common Uses of Hashing
| Use case | What it does |
|---|---|
| Verifying downloads | Compare SHA-256 hash of downloaded file to listed checksum |
| Password storage | Websites store password hashes, not plaintext passwords |
| File change detection | Systems detect file changes by comparing stored hash to current hash |
| Git version control | Git uses SHA hashes to identify every commit and file version |
| Data deduplication | Identical hashes indicate duplicate files |
| Digital signatures | Hash of a document is signed, not the document itself |
What Hashing Is Not
Hashing is not encryption — you can't reverse a hash to get the original. It's not compression — the output is always the same length regardless of input size. It's not the same as a checksum — checksums are simpler error-detection codes, not cryptographic functions.
Use Hash Generator to generate MD5, SHA-1 and SHA-256 hashes. For a related security topic involving hashed tokens, see how JWT tokens work.
Password Hashing vs Data Hashing
One distinction worth making explicit: for storing user passwords, a simple hash like SHA-256 is not appropriate — password-specific algorithms like bcrypt, Argon2 or PBKDF2 are designed to be deliberately slow and include salting, making brute-force attacks much harder. SHA-256 is appropriate for verifying file integrity, digital signatures and general data fingerprinting. Laravel, for example, uses bcrypt by default for password hashing. Hash Generator generates MD5, SHA-1 and SHA-256 for the data integrity use cases.
