What hashing is
A hash function takes an input of any length — a single character, a 4 GB file, anything — and produces a fixed-length output called a digest. The same input always produces the same digest. A different input produces a different digest, and a one-character change to the input produces a completely different digest. This property is called the avalanche effect.
Hashing is one-way by design. Given a digest, there is no mathematical operation that reverses it to recover the original input. This is fundamentally different from encoding schemes like Base64, which are reversible with no key required. A hash function discards information in the process of computing its output.
MD5, SHA-1, SHA-256, SHA-512: which to use
MD5 produces a 128-bit digest, displayed as 32 hexadecimal characters. It is fast, widely supported, and broken for cryptographic purposes — researchers have demonstrated that two different inputs can produce the same MD5 digest (a collision). Use MD5 only for non-security checksums where speed matters: verifying a file download completed without corruption, generating cache keys, or computing legacy checksums where the format is fixed by an external system.
SHA-1 produces a 160-bit digest (40 hex characters). It is also broken for collision resistance and deprecated by NIST for security applications. Git uses SHA-1 internally for commit and object hashing, but is transitioning to SHA-256. Do not use SHA-1 for new security-sensitive work.
SHA-256 produces a 256-bit digest (64 hex characters) and is the current standard recommendation for most applications. TLS certificates, code-signing pipelines, and HMAC authentication all default to SHA-256. It has no known practical weaknesses. SHA-512 produces a 512-bit digest (128 hex characters) and runs faster than SHA-256 on 64-bit processors for large inputs because of its internal block structure. Use SHA-512 where you want additional security margin or when processing large files on 64-bit systems.
Why you can't reverse a hash
The one-way property is not a limitation of computing power — it is built into the algorithm's structure. SHA-256 processes input in 512-bit blocks and applies 64 rounds of bitwise operations, modular additions, and logical functions that mix input bits together irreversibly. Multiple different inputs can produce the same internal state during processing, which means the mapping from digest back to input is not even a well-defined function.
What attackers do instead is precompute a table of inputs and their digests (a rainbow table) and look up a target digest. This is why raw SHA-256 is not safe for password storage even though it is cryptographically strong as a hash: if two users have the same password, they produce the same digest, and a rainbow table built against common passwords will find matches instantly. The correct solution is a password hashing algorithm (bcrypt, Argon2, scrypt) that incorporates a per-user random salt and a tunable work factor to make each computation deliberately slow.
How to generate a hash
Open the hash generator and type or paste your input text into the input field. Select the algorithm — MD5, SHA-1, SHA-256, or SHA-512. The digest appears immediately below, updated in real time as you type. Click the copy button to copy the hex string to clipboard.
For file hashing, use the file upload option. The tool reads the file locally using the browser's File API and computes the hash without uploading anything. A 500 MB file hashes in a few seconds in a modern browser. This is useful for verifying a downloaded installer matches the SHA-256 checksum published by the vendor before you run it.
What developers use hashes for
File integrity verification is the most straightforward use. Hash a file before and after transfer; if the digests match, the file arrived intact. Software vendors publish SHA-256 digests alongside download links so users can confirm the installer was not tampered with between the server and their machine.
Cache busting uses content hashes in filenames or query strings. A CSS file served as style.abc123de.css (where abc123de is the first 8 characters of its SHA-256 digest) changes its URL whenever its content changes, forcing CDN caches and browsers to fetch the new version. Deduplication in storage systems hashes file contents to detect identical files without comparing byte-by-byte. HMAC (Hash-based Message Authentication Code) uses a shared secret key with SHA-256 to sign API requests — the receiver recomputes the HMAC and rejects requests where the signature doesn't match.
For token and key generation that requires randomness rather than determinism, the password generator is a better fit. For encoding binary data as text, see the Base64 encoder/decoder.
Choosing the right algorithm
SHA-256 is the right default for any new work that requires a cryptographic hash. Use MD5 or SHA-1 only when an external system mandates it and you have no choice. Never use a raw hash function for password storage — that requires bcrypt or Argon2 with a salt, which are purpose-built for the problem.
For quick verification, checksums, and developer tasks, the hash generator computes MD5, SHA-1, SHA-256, and SHA-512 in your browser with no upload and no account required.