What a cryptographic hash actually does
A cryptographic hash function takes any input — a password, a file, a JSON payload — and produces a fixed-size string of bytes called a digest. The same input always yields the same digest, and even a one-byte change produces a completely different one.
Good hash functions share four properties:
- One-way (preimage resistance): given a digest, you cannot feasibly recover the original input.
- Fixed-size output: a 10-byte file and a 10-GB file both produce a digest of the same length (128 bits for MD5, 256 bits for SHA-256).
- Deterministic: the same input always maps to the same digest, so hashes can be compared and stored as fingerprints.
- Avalanche effect: flipping a single input bit changes roughly half the output bits, so similar inputs look unrelated.
Here is the avalanche effect with MD5 — note how a single capital letter rewrites the entire digest:
md5("The quick brown fox") = a2004f37730b9445670a738fa0fc9ee5
md5("the quick brown fox") = 4ed47e72a8d6c5042bb7f99b4b431d2cMD5 and SHA-1 are broken — use them only as plain checksums
MD5 produces a 128-bit digest and is extremely fast, but it is cryptographically broken. Researchers can generate collisions — two different inputs that produce the same digest — in seconds on ordinary hardware. SHA-1 (160-bit) is broken too; the 2017 "SHAttered" attack produced two distinct PDFs with the same SHA-1 hash.
Because of this, MD5 and SHA-1 must never be used for anything security-related: digital signatures, certificates, integrity checks against a malicious adversary, or password storage. An attacker who can craft collisions can substitute a malicious file that hashes to the same value as a trusted one.
They are still acceptable for non-adversarial uses where you only care about accidental corruption, such as:
- Deduplication — spotting identical files or rows by their hash.
- Cache keys and ETags — fast, non-security identifiers.
- Checksums for accidental corruption — verifying a download wasn't truncated (though SHA-256 is preferred even here).
SHA-256 is the current standard
SHA-256 is part of the SHA-2 family (which also includes SHA-384 and SHA-512). It produces a 256-bit digest and has no known practical collision or preimage attacks. It is the workhorse behind TLS certificates, code signing, Git object IDs (transitioning from SHA-1), blockchain proofs, and file-integrity manifests.
When you need a hash to resist a deliberate attacker — verifying that a download matches a publisher's posted checksum, signing data, or building a tamper-evident log — reach for SHA-256 (or SHA-512 for extra margin). A typical SHA-256 digest looks like:
sha256("hello") =
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Hashing is NOT encryption
This is the most common and most dangerous misconception. Encryption is reversible: it uses a key, and anyone with the key can decrypt the ciphertext back to plaintext. Hashing is one-way: there is no key and no "decrypt" operation — you cannot un-hash a digest back to its input.
If someone offers to "decrypt an MD5 hash," they are really running a lookup table or brute-forcing guesses until one matches. Treat a hash as a fingerprint, not as protected, recoverable data.
Why a fast hash is wrong for passwords
You should never store passwords with a plain MD5, SHA-1, or even SHA-256. The very thing that makes these hashes good for files — they are blazing fast — makes them terrible for passwords. An attacker who steals your database can compute billions of fast hashes per second on a GPU and crack common passwords quickly. Plain hashing also lets identical passwords share the same digest.
For passwords, use a slow, salted key derivation function (KDF) designed to resist brute force:
- Argon2 — the modern winner of the Password Hashing Competition; memory-hard and tunable.
- scrypt — also memory-hard, resisting GPU and ASIC attacks.
- bcrypt — battle-tested and widely supported.
These functions add a unique salt per password (so identical passwords differ) and a deliberately high work factor (so each guess is expensive). General-purpose hashes like SHA-256 have none of that built in.
Quick reference: when to use which
- Verify a download / file integrity vs. attackers: SHA-256.
- Digital signatures, certificates, code signing: SHA-256 or SHA-512.
- Dedup, cache keys, non-security fingerprints: MD5 is fine (fast and convenient).
- Storing passwords: Argon2, scrypt, or bcrypt — never a bare hash.
- Legacy systems forcing MD5/SHA-1 for security: migrate; they are not safe.
Try it in Formatly's Hash Generator
Formatly's Hash Generator computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests for any text you paste. It's a great way to see the avalanche effect, compare digest lengths, and confirm a file's checksum against a publisher's posted value. Everything runs 100% in your browser — your input is never uploaded to a server, so you can safely experiment with sensitive strings while you learn how each algorithm behaves.