What is a cryptographic hash?
A cryptographic hash function takes any input — a word, a document, an entire file — and produces a fixed-length string of characters called a digest or hash. The same input always produces the same hash, but even a tiny change in the input (one character, one bit) produces a completely different hash. This property, called the avalanche effect, makes hashes useful for detecting changes and verifying integrity.
Critically, hash functions are one-way: you cannot work backwards from a hash to recover the original input. This is what makes them useful for password storage — a database stores the hash, not the password, so even if the database leaks, the actual passwords are not exposed.
MD5
MD5 produces a 128-bit (32 character) hash. It was once the standard for checksums and password hashing but is now considered cryptographically broken — it is computationally feasible to find two different inputs that produce the same MD5 hash (a "collision"). MD5 is still widely used for non-security purposes like detecting accidental file corruption or generating cache keys, where collision resistance is not critical. Never use MD5 for passwords or security-sensitive applications.
SHA-1
SHA-1 produces a 160-bit (40 character) hash. It was the successor to MD5 and was used for decades in SSL certificates, Git (which uses SHA-1 for commit hashes), and code signing. SHA-1 is now deprecated for security applications — Google demonstrated a practical collision attack (SHAttered) in 2017. Modern browsers reject SHA-1 SSL certificates.
SHA-256
SHA-256 is part of the SHA-2 family and produces a 256-bit (64 character) hash. It is the current standard for most security applications: TLS certificates, code signing, blockchain (Bitcoin uses SHA-256), JWT signatures, and password hashing schemes like bcrypt use it internally. When in doubt, SHA-256 is the right choice.
SHA-512
SHA-512 produces a 512-bit (128 character) hash. It offers stronger collision resistance than SHA-256 and is faster on 64-bit hardware due to its architecture. Use it when you want maximum security margin — for example, hashing highly sensitive data or when future-proofing against advances in computing power.
Verifying file integrity
Software download pages often list a SHA-256 checksum next to the download link. After downloading the file, use the "Hash a file" feature to generate its SHA-256 hash and compare it to the published checksum. If they match, the file was not tampered with in transit. If they differ, the file may be corrupted or maliciously altered — do not use it.
Privacy
All hashing uses the browser's Web Crypto API. No data is sent to any server. Files you upload for hashing never leave your device.