Hash Functions Explained: MD5, SHA-1, SHA-256, and SHA-512

What is a Hash Function?

A hash function takes an input of any size and produces a fixed-size output called a hash, digest, or checksum. The same input always produces the same hash, but you cannot reverse-engineer the input from the hash.

Key Properties of Cryptographic Hash Functions

• Deterministic — The same input always produces the same hash
• One-way (pre-image resistance) — You cannot reverse the hash to get the original input
• Avalanche effect — A tiny change in input produces a completely different hash
• Collision resistance — It should be computationally impossible to find two inputs with the same hash
• Fixed output size — Regardless of input length, the hash is always the same length

Common Hash Algorithms

MD5 (128-bit / 32 hex chars)

MD5 was the standard for many years but is now cryptographically broken. Collisions can be found in seconds on modern hardware. Use MD5 only for non-security purposes like checksums for detecting accidental corruption.

MD5("hello") = 5d41402abc4b2a76b9719d911017c592

SHA-1 (160-bit / 40 hex chars)

SHA-1 is also considered cryptographically broken since Google demonstrated a practical collision in 2017 (the "SHAttered" attack). Avoid SHA-1 for security-critical applications. Still widely used in Git for file identification.

SHA1("hello") = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

SHA-256 (256-bit / 64 hex chars)

SHA-256 is part of the SHA-2 family and is currently the recommended standard for most security applications. It is used in Bitcoin, TLS/HTTPS certificates, code signing, and password hashing (often combined with bcrypt or Argon2).

SHA256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

SHA-512 (512-bit / 128 hex chars)

SHA-512 is the most secure in the SHA-2 family. It provides greater security margins but is slower and produces larger hashes. Use it when maximum security is required.

Common Use Cases for Hashing

• Password storage — Store hashes of passwords, never plain text (use bcrypt/Argon2 which add salting)
• File integrity verification — Compare hash before and after download to detect corruption
• Digital signatures — Hash the document, then sign the hash
• Data deduplication — Identify duplicate files by comparing hashes
• Content addressing — Git identifies commits and files by their SHA-1 hash
• Blockchain — Bitcoin uses double SHA-256 for its proof-of-work

Hashing vs Encryption

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes instantly with our free Hash Generator — all processing happens in your browser.