What Is Hashing? A Plain-English Guide to MD5, SHA-256, and Beyond

Every time you download software, verify a file, or log into a website, hashing is working behind the scenes. A hash function takes any input — a single character, a novel, a 4 GB video file — and produces a fixed-length "fingerprint" that's practically impossible to reverse.

Understanding hashing isn't just for security professionals. If you've ever checked an "MD5 checksum" after downloading a file, you've already used hashing. Here's how it actually works.

Hashing in 30 Seconds

A hash function takes input of any size and produces output of a fixed size. SHA-256, for example, always produces 64 hexadecimal characters (256 bits) regardless of whether the input is "hi" or the entire works of Shakespeare.

Three properties make hash functions useful: they're deterministic (same input always produces the same output), they're one-way (you can't reverse the hash to find the input), and they're collision-resistant (it's extremely hard to find two different inputs that produce the same hash).

The Algorithm Zoo: MD5, SHA-1, SHA-256, SHA-512

MD5 — Fast but Broken

MD5 produces a 128-bit (32-character) hash. It was the standard for decades, but researchers found practical collision attacks in 2004. Two completely different files can now be crafted to produce the same MD5 hash. It's still useful for checksums and non-security data deduplication, but never use MD5 for anything security-related.

SHA-1 — Retired in 2017

SHA-1 produces a 160-bit (40-character) hash. Google demonstrated a practical collision in 2017 (the SHAttered attack). Major browsers stopped trusting SHA-1 SSL certificates the same year. Like MD5, it's fine for non-security checksums but shouldn't be trusted for anything important.

SHA-256 — The Current Standard

SHA-256 produces a 256-bit (64-character) hash. It's part of the SHA-2 family designed by the NSA and published by NIST. No practical collisions have been found. Bitcoin uses SHA-256 for its proof-of-work system. Most SSL/TLS certificates, code signing, and integrity verification tools use it today.

SHA-512 — Extra Margin

SHA-512 produces a 512-bit (128-character) hash. It offers a wider security margin than SHA-256 and is actually faster on 64-bit processors because its internal operations align with 64-bit word sizes. It's commonly used in high-security environments and digital signatures.

Real-World Uses of Hashing

• File integrity verification — download a file, compute its SHA-256, compare to the published checksum
• Git version control — every commit is identified by a SHA-1 hash of its content
• Digital signatures — sign the hash of a document, not the document itself (much faster)
• Data deduplication — store identical files only once by comparing their hashes
• Blockchain — each block contains the hash of the previous block, creating an immutable chain

Hashing Is NOT Encryption

This is also why you should never use raw SHA-256 for password storage. Hashing is fast by design, which means attackers can test billions of password guesses per second. Password hashing algorithms like bcrypt and Argon2 are intentionally slow to make brute-force attacks impractical.

Our Hash Generator computes all four algorithms instantly in your browser using the Web Crypto API for SHA and a pure-JavaScript implementation for MD5. No data leaves your device — useful when you need to verify sensitive files without uploading them.