Hash Generator

How Cryptographic Hash Functions Work

A hash function takes an input of any length and produces a fixed-length output called a hash, digest, or checksum. The same input always produces the same output. A tiny change in the input — even a single character — produces a completely different hash. This property, called the avalanche effect, makes hashes useful for verifying data integrity.

Hash functions are one-way: it is computationally infeasible to reverse a hash back to the original input. This is what makes them useful for storing passwords, verifying file integrity, and creating digital signatures. When verifying a downloaded file, you hash the file and compare the result to the published checksum — if they match, the file is intact. If you need to encode data reversibly, use our Base64 Encoder instead.

Algorithm Comparison

MD5 and SHA-1 — Why They Still Appear

MD5 and SHA-1 are cryptographically broken, meaning collision attacks are feasible — two different inputs can be engineered to produce the same hash. This matters for security applications like digital signatures or certificates. However, they remain widely used for non-security purposes like verifying accidental data corruption, generating cache keys, or creating quick fingerprints where collision resistance isn't required. If you need to verify a file download and the publisher provides an MD5 checksum, it is still useful for detecting accidental corruption, just not deliberate tampering.

Frequently Asked Questions

What is a hash and what is it used for?

A hash is a fixed-length string produced by running data through a hash function. The same input always produces the same hash, and any change to the input produces a completely different hash. Hashes are used to verify file integrity, store passwords securely, create digital signatures, generate cache keys, and detect duplicate data. They are one-way — you cannot reverse a hash to recover the original input.

What is the difference between MD5, SHA-1, and SHA-256?

The main differences are output length and security. MD5 produces a 128-bit (32 character) hash and is cryptographically broken. SHA-1 produces a 160-bit (40 character) hash and is deprecated. SHA-256 produces a 256-bit (64 character) hash and is currently secure and widely recommended. SHA-512 produces a 512-bit (128 character) hash for applications requiring maximum strength. For any security-sensitive use, choose SHA-256 or SHA-512.

Can I reverse a hash to get the original text?

No — hash functions are designed to be one-way. There is no mathematical operation to reverse a hash. However, short or common inputs like passwords can be cracked using rainbow tables (precomputed hash databases). This is why passwords should always be hashed with a slow, salted algorithm like bcrypt or Argon2 rather than the fast algorithms shown here, which are designed for data integrity, not password storage.

Why does a tiny change in input produce a completely different hash?

This is the avalanche effect — a deliberate property of cryptographic hash functions. Changing even one bit in the input causes roughly half the output bits to change. This makes it impossible to manipulate input to get a desired output, and ensures that similar inputs don't produce similar hashes. It is how hash functions can detect even single-character changes in a large file.

Is it safe to hash sensitive data in this tool?

Yes — all hashing runs entirely in your browser using the Web Crypto API, a built-in browser feature. No data is sent to any server. You can safely hash API keys, tokens, or other sensitive strings. That said, hashing alone does not encrypt data — if someone obtains the hash of a known string, they can verify a match. For encoding data reversibly, see our Base64 Encoder.

How do I verify a file checksum?

A file checksum is a hash of the file's contents. To verify a download, the publisher provides the expected hash (usually SHA-256). You hash the downloaded file using the same algorithm and compare the result. If they match, the file is intact and unmodified. This tool works on text input — for file checksums, use your operating system's built-in tools: sha256sum on Linux/Mac or Get-FileHash in Windows PowerShell.