Hash Generator: Frequently Asked Questions

For general use and file integrity verification, SHA-256. For password storage, use bcrypt or Argon2 (not a raw hash). For legacy compatibility, MD5 is still used for non-security checksums. Avoid SHA-1 and MD5 for any security-sensitive application.

No. Cryptographic hash functions are one-way by design. You cannot compute the input from the output. However, common passwords can be looked up in rainbow tables — which is why password hashing requires salting.

This is called a collision. For MD5 and SHA-1, practical collisions have been demonstrated. SHA-256 and SHA-512 have no known practical collisions — the output space (2^256 possibilities) is too large for current or foreseeable computing hardware.

SHA-256 hashing speed on modern hardware is typically 1–3 GB/s. A 1GB file takes under a second in a native application; browser-based hashing via the Web Crypto API is somewhat slower but still processes most typical files in seconds.

A checksum is any value computed from data to detect errors — it may be as simple as a sum of bytes. A cryptographic hash is a checksum specifically designed to be collision-resistant and one-way. All cryptographic hashes are checksums, but not all checksums are cryptographic hashes.

No — MD5 is still fine for non-security uses like detecting accidental corruption, generating cache keys, or as a fast deduplication identifier where adversarial input is not a concern. It is only broken for security applications where resistance to intentional collisions matters.