Cryptographic hash functions are the backbone of data integrity, password storage, and digital signatures. Understanding how they work helps you choose the right algorithm and avoid common security pitfalls.

What Is a Hash?

A hash function takes any input data and produces a fixed-size string of characters. The output (hash or digest) is deterministic — the same input always produces the same output.

Key properties:

Deterministic — same input → same output, always
Fast to compute — efficient for any input size
One-way — you cannot reverse a hash to get the input
Collision-resistant — different inputs rarely produce the same hash

Common Hash Algorithms

MD5 (128-bit)

md5("hello") = 5d41402abc4b2a76b9719d911017c592

Output: 32 hex characters (128 bits)
Status: Broken — collisions found, don't use for security
Still useful for: Checksums, file deduplication (non-security contexts)

SHA-1 (160-bit)

sha1("hello") = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

Output: 40 hex characters (160 bits)
Status: Deprecated — Google demonstrated collisions in 2017
Still used in: Git commit hashes (non-security context)

SHA-256 (256-bit)

sha256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Output: 64 hex characters (256 bits)
Status: Secure — widely used, no known practical attacks
Use for: Passwords, digital signatures, certificates, Bitcoin mining

SHA-512 (512-bit)

Output: 128 hex characters (512 bits)
Status: Secure — same security as SHA-256 but with larger output
Use for: High-security applications, certificate transparency logs

Comparison

| Algorithm | Output Size | Security | Speed | Use Case | |-----------|-------------|----------|-------|----------| | MD5 | 128 bits | Broken | Fast | Checksums only | | SHA-1 | 160 bits | Deprecated | Fast | Legacy (Git) | | SHA-256 | 256 bits | Secure | Moderate | General purpose | | SHA-512 | 512 bits | Secure | Fast (64-bit) | High security | | SHA-3 | 256 bits | Secure | Moderate | Alternative to SHA-2 | | bcrypt | Variable | Secure | Slow | Password hashing |

Generate Hashes in Code

JavaScript (Web Crypto API)

async function hash(data, algorithm = 'SHA-256') {
  const encoder = new TextEncoder();
  const buffer = await crypto.subtle.digest(algorithm, encoder.encode(data));
  return Array.from(new Uint8Array(buffer))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

// Usage
const sha256 = await hash("hello");
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

const sha512 = await hash("hello", 'SHA-512');

Python

import hashlib

# SHA-256
hashlib.sha256(b"hello").hexdigest()
# "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

# MD5
hashlib.md5(b"hello").hexdigest()
# "5d41402abc4b2a76b9719d911017c592"

# SHA-512
hashlib.sha512(b"hello").hexdigest()

Command Line

# SHA-256
echo -n "hello" | sha256sum

# MD5
echo -n "hello" | md5sum

# SHA-512
echo -n "hello" | sha512sum

HMAC: Authenticated Hashing

HMAC (Hash-based Message Authentication Code) combines a hash with a secret key:

async function hmac(data, key) {
  const encoder = new TextEncoder();
  const cryptoKey = await crypto.subtle.importKey(
    'raw', encoder.encode(key),
    { name: 'HMAC', hash: 'SHA-256' },
    false, ['sign']
  );
  const signature = await crypto.subtle.sign('HMAC', cryptoKey, encoder.encode(data));
  return Array.from(new Uint8Array(signature))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

const mac = await hmac("message", "secret-key");

Common Mistakes

Using MD5 for passwords — it's too fast. Use bcrypt, scrypt, or Argon2 instead.
Comparing hashes with === — this is vulnerable to timing attacks. Use constant-time comparison.
Hashing without salting — for passwords, always use a unique salt per password.
Trusting hash alone for integrity — in adversarial contexts, use HMAC with a secret key.
Confusing hashing with encryption — hashing is one-way, encryption is reversible.

Try It Now

Use our free Hash Generator to generate MD5, SHA-1, SHA-256, and SHA-512 hashes instantly — with file upload support and HMAC capabilities.