Hash generator (MD5, SHA-1, SHA-256)

What a hash function does

A cryptographic hash takes any input — a word, a paragraph, a whole file — and produces a fixed-size fingerprint called a digest. SHA-256 always returns 64 hex characters whether you feed it one letter or a gigabyte. Three properties make it useful: it is deterministic (the same input always gives the same digest), it is fast to compute but practically impossible to reverse, and a tiny change to the input — flipping a single bit — produces a completely different-looking output (the "avalanche effect"). Together these let a short string stand in as a reliable proxy for a much larger piece of data.

Integrity, not secrecy

The classic use is verifying that data arrived intact. When a download lists a SHA-256 checksum, you hash the file you received and compare: if the digests match, the bytes are identical; if not, the file is corrupt or tampered with. The same idea underpins content-addressing (a Git commit ID is a hash of its contents) and digital signatures (you sign the hash, not the whole document). What hashing does not do is keep data secret. Because it is deterministic, anyone can hash a guess and check it against your digest — so for low-entropy inputs like a password or an email address, a hash is readable to anyone willing to try the obvious candidates.

Choosing an algorithm — and what's broken

For anything that an attacker might try to fool, use SHA-256 or stronger. MD5 and SHA-1 are broken: it is now feasible to construct two different inputs that share the same digest (a collision), which defeats signatures and tamper-evidence — SHA-1 collisions have been demonstrated in the real world. They are kept here because they are still everywhere as non-adversarial checksums and in legacy systems, where speed matters and nobody is actively attacking the hash. The longer SHA-384 and SHA-512 add margin and can be faster on 64-bit hardware, but SHA-256 is the sensible default.

Why these are the wrong tool for passwords

It is tempting to "secure" a password by storing its SHA-256, but general-purpose hashes are designed to be fast, and fast is exactly wrong here — a stolen database of SHA-256 password hashes can be attacked at billions of guesses per second. Passwords need a deliberately slow, salted password-hashing function (bcrypt, scrypt or Argon2) that makes each guess expensive and adds a unique salt so identical passwords don't share a digest. Use this tool for checksums, fingerprints and verification; reach for a real password-hashing library when you store credentials. To generate strong secrets in the first place, see the password generator; to encode rather than hash data, the Base64 tool is the reversible counterpart. Writing your own? Our guide to hashing a string with SHA-256 in JavaScript walks through the Web Crypto digest call and the hex conversion.