What is a hash function?

A hash function takes any input text and produces a fixed-length string of characters, called a hash or digest, that acts as a unique fingerprint of that input. Even a tiny change to the input produces a completely different hash, which makes hashes useful for verifying data integrity and detecting tampering.

What is the difference between MD5, SHA-1 and SHA-256?

MD5 produces a 128-bit hash and is fast but considered cryptographically broken for security purposes. SHA-1 produces a 160-bit hash and is also deprecated for security use. SHA-256 produces a 256-bit hash and is currently considered secure and is the industry standard for most modern applications, including blockchain and TLS certificates.

Is MD5 safe to use for passwords?

No. MD5 should never be used to store passwords. It is fast to compute, which makes it vulnerable to brute-force and rainbow-table attacks, and it has known collision vulnerabilities. Modern password storage should use a dedicated algorithm like bcrypt, scrypt, or Argon2, not a general-purpose hash function.

Can two different inputs produce the same hash?

In theory, yes — this is called a collision, and every hash function has them because it maps unlimited input to a fixed-length output. For MD5 and SHA-1, practical collision attacks have been demonstrated, which is why they are avoided for security-critical use. SHA-256 and above have no known practical collision attacks.

What is a hash used for besides passwords?

Hashes are used to verify file downloads haven't been corrupted or tampered with, to detect duplicate files, to create unique identifiers for data, in Git commit hashes, in blockchain block linking, and in digital signatures and certificate verification.

How do I verify a file's checksum using this tool?

This tool hashes text input, not files directly. To verify a downloaded file, use your operating system's checksum utility to generate its hash, then paste that hash into the verifier here alongside the hash published by the file's source to confirm they match.

Why do MD5 and SHA-256 give completely different results for the same text?

Each hash algorithm uses a different internal mathematical process and produces a different output length — MD5 outputs 128 bits (32 hex characters) while SHA-256 outputs 256 bits (64 hex characters). There is no relationship between the outputs of different algorithms for the same input.

Free Hash Generator – MD5, SHA-1, SHA-256, SHA-512 Online (2026)

📋 In This Guide

Why hash functions matter
MD5 vs SHA-1 vs SHA-256 vs SHA-512
How a hash function works — the core idea
Worked example — one character changes everything
Common real-world uses of hashing
5 common hashing mistakes to avoid
Frequently asked questions

Why Hash Functions Matter

A hash function takes any input — a word, a password, an entire file — and produces a fixed-length string of characters called a hash or digest. The same input always produces the same hash, but even a one-character change in the input produces a completely different, unpredictable output. This property makes hashes essential for verifying that data hasn't been altered, corrupted, or tampered with.

Developers use hash functions constantly: to verify downloaded file integrity, to generate unique identifiers, to power Git's commit history, to link blocks in a blockchain, and — historically, though no longer recommended — to store passwords. Understanding which algorithm to reach for, and why, matters more than most people realise.

📦

File Integrity

Confirm a download matches the publisher's checksum

🔗

Git & Blockchain

Commit hashes and block hashes rely on this exact mechanism

🆔

Unique IDs

Deterministic identifiers derived from content itself

🔏

Digital Signatures

Certificates and signatures hash data before signing it

MD5 vs SHA-1 vs SHA-256 vs SHA-512

Algorithm	Output Length	Security Status	Typical Use Today
MD5	128-bit (32 hex chars)	Broken — collisions demonstrated	Non-security checksums only (e.g. detecting accidental corruption)
SHA-1	160-bit (40 hex chars)	Deprecated — collisions demonstrated	Legacy systems being phased out
SHA-256	256-bit (64 hex chars)	Secure, industry standard	TLS certificates, Bitcoin, most modern applications
SHA-384	384-bit (96 hex chars)	Secure, extra margin	High-assurance applications
SHA-512	512-bit (128 hex chars)	Secure, largest output	Applications wanting maximum digest length

⚠️ MD5 and SHA-1 are still fine for non-security tasks like quickly checking if two files are identical, but should never be relied on where an attacker could deliberately try to forge a matching hash.

How a Hash Function Works — The Core Idea

Every cryptographic hash function shares three key properties, regardless of the specific algorithm:

Core Properties

1. Deterministic — same input always gives the same output.
2. Fixed output length — regardless of input size, from one character to a multi-gigabyte file.
3. Avalanche effect — a tiny input change produces a completely different, unpredictable output.

Internally, algorithms like MD5 and SHA process the input in fixed-size blocks, mixing the bits through repeated rounds of bitwise operations, modular addition, and non-linear functions — designed so that reversing the process (recovering the input from the hash) is computationally infeasible.

Worked Example — One Character Changes Everything

SHA-256 of "ToolLoom"

Input: ToolLoom

SHA-256 output: a completely unique 64-character hex string

Now change just one letter — "toolLoom" (lowercase t) — and the entire hash changes completely, with no visible pattern connecting the two outputs.

Try it yourself in the generator above: type "ToolLoom", note the SHA-256 hash, then change one character and generate again. This unpredictability — called the avalanche effect — is precisely what makes hashes useful for detecting even the smallest tampering.

Need to work with timestamps in your data too?

Convert Unix epoch values to IST or UTC dates and back.

Open Timestamp Converter →

Common Real-World Uses of Hashing

File Integrity Verification

Software publishers often list a SHA-256 checksum next to a download link. After downloading, you can hash the file yourself and compare it to the published value — if they match, the file wasn't corrupted or tampered with in transit.

Git Version Control

Every commit in Git is identified by a SHA-1 hash (moving toward SHA-256 in newer Git versions) computed from the commit's content and metadata — which is why two commits with even slightly different content always get completely different hashes.

Blockchain and Cryptocurrency

Blockchains like Bitcoin use SHA-256 extensively — each block contains the hash of the previous block, cryptographically chaining them together and making retroactive tampering computationally impractical.

Duplicate File Detection

Rather than comparing entire files byte-by-byte, many tools hash each file and compare the (much shorter) hashes instead — a fast way to find duplicates across large storage systems.

5 Common Hashing Mistakes to Avoid

Mistake 1 — Using MD5 or SHA-1 for password storage

✗ Wrong: Storing user passwords as a plain MD5 or SHA-1 hash

✓ Right: Use bcrypt, scrypt, or Argon2 — algorithms deliberately designed to be slow

General-purpose hashes like MD5/SHA-256 are fast by design, which is exactly what makes them weak against brute-force password cracking.

Mistake 2 — Hashing without a "salt" for password-like data

✗ Wrong: Hashing the same password for every user with no random salt

✓ Right: Add a unique random salt per record before hashing, or use an algorithm that handles this automatically

Without a salt, identical passwords produce identical hashes, making them vulnerable to precomputed rainbow-table attacks.

Mistake 3 — Assuming a matching MD5 hash proves authenticity

✗ Wrong: Trusting an MD5 checksum to prove a file hasn't been maliciously altered

✓ Right: Use SHA-256 or higher when the file's authenticity actually matters for security

MD5 collisions can be deliberately engineered, so it only reliably catches accidental corruption, not intentional tampering.

Mistake 4 — Forgetting that whitespace changes the hash

✗ Wrong: Comparing two hashes where one input had a trailing space or newline

✓ Right: Trim and normalise text carefully before hashing if you need consistent results

Hash functions treat every byte literally — an invisible trailing space produces a completely different hash.

Mistake 5 — Mixing up which algorithm produced which hash

✗ Wrong: Comparing a SHA-256 hash against an expected MD5 value

✓ Right: Always confirm which algorithm the source used — check length first (32, 40, 64 or 128 hex characters)

Hash length is a quick sanity check: 32 characters is almost certainly MD5, 64 is almost certainly SHA-256.

Frequently Asked Questions

A hash function takes any input and produces a fixed-length digest that acts as a unique fingerprint of that input. Even a tiny input change produces a completely different hash, which makes hashes useful for verifying data integrity.

MD5 produces a 128-bit hash and is cryptographically broken. SHA-1 produces a 160-bit hash and is also deprecated. SHA-256 produces a 256-bit hash and is currently considered secure — the industry standard for most modern applications.

No. MD5 is fast to compute, making it vulnerable to brute-force and rainbow-table attacks. Modern password storage should use bcrypt, scrypt, or Argon2 instead.

In theory yes — called a collision — since any hash function maps unlimited input to fixed-length output. Practical collision attacks exist for MD5 and SHA-1, which is why they're avoided for security-critical use. SHA-256 and above have no known practical collision attacks.

Hashes verify file downloads haven't been corrupted, detect duplicate files, create unique identifiers, power Git commit hashes, link blockchain blocks, and support digital signatures and certificate verification.

No. All hashing happens instantly inside your browser using JavaScript and the Web Crypto API. Nothing you type is uploaded, logged, or stored on any server.

This tool hashes text, not files directly. Use your operating system's checksum utility to generate a file's hash, then paste it into the verifier here alongside the hash published by the file's source to confirm they match.

Each algorithm uses a different internal process and output length — MD5 outputs 128 bits while SHA-256 outputs 256 bits. There is no relationship between the outputs of different algorithms for the same input.