Cryptographic Hash Functions, Explained
What a cryptographic hash is, how MD5, SHA-1, SHA-256 and SHA-512 compare, how checksums verify downloads, and why fast hashes are wrong for passwords.
By Udit Agarwal · Updated October 17, 2026
A cryptographic hash function turns any input, from a single word to a multi-gigabyte file, into a short fixed-length fingerprint called a digest. The same input always gives the same digest, you cannot work backwards from a digest to its input, and nobody should be able to find two inputs that share one. The SHA-256 digest of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 on every computer, which is what makes hashes useful for checking downloads, signing data and, with the right algorithm, storing passwords.
A hash function mixes the bytes of its input through many rounds of bit operations. Four things are always true:
Digests are usually written in hexadecimal, two characters per byte, so a 256-bit digest is 64 hex characters. Here is hello through the algorithms you meet most often:
MD5 5d41402abc4b2a76b9719d911017c592
SHA-1 aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Hashing is easy to confuse with two other things. Encryption can be reversed by anyone who holds the key. Encoding, such as Base64, can be reversed by anyone at all. A hash has no key and no way back: you can only hash a candidate input and compare digests.
A cryptographic hash makes three promises that hold even against a determined attacker:
Collisions must exist, because there are infinitely many inputs and only 2^256 possible SHA-256 digests. The point is that nobody can find one. Because of the birthday paradox, a brute-force collision search takes about 2^(n/2) attempts for an n-bit hash: roughly 2^128, or 3.4 × 10^38, for SHA-256.
The avalanche effect shows this in practice: change one bit of the input and about half the digest bits flip, in a pattern that looks random. Capitalizing one letter is enough:
hello 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Hello 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
The two digests differ in 125 of their 256 bits.
"Except by guessing" deserves a warning. Preimage resistance only protects inputs that are hard to guess. A hashed email address or phone number is not anonymous, because anyone can hash a list of likely candidates and look for a match.
| Algorithm | Digest size | Standard | Collision resistance today |
|---|---|---|---|
| MD5 | 128 bits (32 hex) | RFC 1321, 1992 | Broken: collisions take seconds |
| SHA-1 | 160 bits (40 hex) | FIPS 180-1, 1995 | Broken: public collisions since 2017 |
| SHA-256 | 256 bits (64 hex) | FIPS 180-2, 2002 | No practical attack known |
| SHA-384 | 384 bits (96 hex) | FIPS 180-2, 2002 | No practical attack known |
| SHA-512 | 512 bits (128 hex) | FIPS 180-2, 2002 | No practical attack known |
MD5 fell first. Practical collisions were published in 2004, and today an ordinary laptop finds one in seconds. Attackers have used them for real forgeries: the Flame malware, discovered in 2012, carried a fake Microsoft code-signing certificate built with an MD5 collision.
SHA-1 lasted longer. In February 2017, researchers from CWI Amsterdam and Google published SHAttered, two different PDF files with the same SHA-1 digest, found after about 9.2 quintillion (2^63) SHA-1 computations. In 2020 researchers went further with a chosen-prefix collision, the more dangerous kind, and NIST has said SHA-1 should be retired completely by the end of 2030.
Neither break lets anyone reverse a digest. The attacks produce collisions, which matter wherever a hash vouches for a document, a certificate or a software release. MD5 still catches accidental corruption, so you will see it next to many downloads, but choose SHA-256 when the choice is yours.
SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family, now specified in FIPS 180-4. SHA-256 is the everyday default for checksums, digital signatures and certificates, and SHA-384 and SHA-512 give longer digests from the same design. SHA-3 (FIPS 202, 2015) uses a different construction and was standardized as an alternative to SHA-2, not a replacement. The SHA-3 & Keccak Hash Generator computes it.
A checksum is a hash published next to a file so you can confirm that your copy is identical, byte for byte, to the one the publisher hashed. Compute the digest of your copy and compare:
sha256sum ubuntu.isoshasum -a 256 ubuntu.isoGet-FileHash ubuntu.iso (SHA-256 by default)The File Hash Checksum tool does the same job in the browser: drop a file and it computes the MD5, SHA-1, SHA-256 and SHA-512 digests together, then checks a pasted expected value against all four. It ignores letter case, surrounding spaces and a trailing file name, so you can paste a line straight from a checksum file.
A checksum proves the file matches the published hash, and nothing more. If an attacker can change the download page, they can change the hash beside it too, which is why careful projects also sign their checksum files. If you only need to catch accidental damage, a 32-bit CRC is enough, and the CRC32 Checksum Calculator computes the variant used in ZIP files and Ethernet.
A site should store something it can check your password against, never the password itself. A SHA-256 digest looks like the answer, but its speed works against it. A single modern graphics card computes billions of SHA-256 digests per second, so an attacker who steals the database can test billions of guesses per second, per card. Unsalted hashes make it worse: everyone who chose the same password gets the same digest, and the SHA-256 of password (5e884898da28…) appears in public lookup lists.
Password hashing functions are designed for this job:
All three add a random salt to each password, so two people with the same password get different hashes and precomputed tables become useless. A bcrypt hash carries everything needed to check it later:
$2a$10$4vC/lkV6gw4nxQDRG/bYIelrrcStrTA7scnkroQPvcM8JCW18X6RC
That is the variant (2a), the cost (10, meaning 2^10 rounds), a 22-character salt and a 31-character hash, 60 characters in all. Hash the same password again and you get a different string, because the salt is new. One quirk to know: bcrypt only uses the first 72 bytes of a password. The Bcrypt Generator hashes a password at a cost from 4 to 15 (10 by default) and verifies a password against an existing hash. For the passwords themselves, see what makes a password strong.
A plain digest proves nothing about who made it, because anyone can hash anything. HMAC, defined in RFC 2104, mixes a secret key into the hash in two nested passes, so only someone holding the key can produce or check the result. It signs webhooks, API requests and JSON Web Tokens that use HS256. Hashing the key and message together is not a safe shortcut with SHA-256 or SHA-512: an attacker who sees one valid digest can extend the message and compute a matching digest without the key. With the key secret, the HMAC-SHA256 of hello is 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b. The HMAC Generator computes HMACs with SHA-256, SHA-1, SHA-384 or SHA-512, takes the key as text or hex, and shows the result in hex and Base64.
When two tools disagree about the same input, the bytes they hashed are almost always different:
echo hello | sha256sum hashes hello plus a line break and prints 5891b5b522d5…. Use printf '%s' hello instead. Text from Windows may also end lines with \r\n rather than \n.é can be stored as one character or as e plus a combining accent. They look identical and hash differently.Letter case never matters: 2CF24DBA… and 2cf24dba… are the same digest.
The Hash Generator computes SHA-256 (the default), SHA-1, SHA-384 and SHA-512 digests of the text you type or paste. It encodes the text as UTF-8, updates the digest as you type, shows it in lowercase hex with its size in bits, and copies it in one click. The hashing uses the browser's built-in Web Crypto API, so it runs on your device and your text is not uploaded.
It hashes text only, with no salt and no key, and it does not offer MD5. For other jobs, use the matching tool: File Hash Checksum for files, the MD5 Hash Generator for MD5, the Bcrypt Generator for passwords and the HMAC Generator for keyed signatures.
Can a hash be reversed or decrypted? No. A hash has no key and throws information away, so there is nothing to decrypt. Short or common inputs can still be found by guessing: an attacker hashes candidates until one digest matches, which is why passwords need slow, salted hashing.
Is SHA-256 still secure? Yes. No practical attack on its preimage or collision resistance is known, and a brute-force collision search would need about 2^128 attempts.
Is MD5 safe to use? Not for anything security-related. MD5 collisions can be produced in seconds, so it cannot vouch for a file or certificate that an attacker might have prepared. It is still acceptable for spotting accidental corruption when nobody is trying to fool you.
What is the difference between SHA-256 and SHA-512? Both belong to the SHA-2 family. SHA-512 produces a 512-bit digest (128 hex characters) and SHA-256 a 256-bit digest (64 hex characters). Both are considered secure, and SHA-256 is the more common choice.
Should I hash passwords with SHA-256? No. SHA-256 is fast, which helps an attacker test billions of guesses per second. Use a password hashing function such as Argon2id, scrypt or bcrypt, which is slow on purpose and adds a random salt to every password.
What is the difference between a hash and a checksum? A checksum is any short value used to detect changes in data. Cryptographic hashes such as SHA-256 make good checksums that also resist deliberate tampering, while simple checksums such as CRC32 only catch accidental errors.
All Security tools · All guides