Cryptographic hashes: the digital fingerprint of data
A cryptographic hash function is an algorithm that transforms an input of any size (a 1-byte or 10 GB file) into a fixed-length string called a digest or hash. The fundamental properties of a good cryptographic hash are three: it is deterministic (the same input always produces the same hash), it is one-way (you cannot derive the input from the hash), and it is collision-resistant (it is practically impossible to find two different inputs with the same hash). These properties make hashes fundamental to information security.
Our Hash Generator calculates hashes with the most widely used algorithms: MD5 (128-bit, deprecated for security but still used for checksums), SHA-1 (160-bit, deprecated), SHA-256 (256-bit, the current standard), and SHA-512 (512-bit, for extra security). Simply enter the text and the tool instantly calculates the hash with all algorithms, allowing comparison and verification.
Which algorithm to choose
For general use (file integrity verification, digital signatures, blockchain), SHA-256 is the standard. For password storage, do not use any of these: you need specific algorithms like bcrypt, scrypt or Argon2 that are deliberately slow to resist brute-force. MD5 and SHA-1, despite their cryptographic vulnerabilities, are still used for non-security checksums: verifying if a download is corrupted, generating unique IDs, or deduplicating files.
Practical uses of hashes
File integrity verification: when you download software, the site often publishes the SHA-256 hash of the file. Calculate the hash of the downloaded file with our tool and compare it with the published one. If they match, the file is intact and has not been altered (by malware or a compromised mirror). To generate secure passwords to use as input for hashing, use our Password Generator which produces cryptographically random strings.
In the world of web security, hashes protect stored passwords: the server never saves the password in plain text, but its hash. During login, it calculates the hash of the input and compares it with the stored one. If the database is compromised, the attacker only gets the hashes, not the passwords. To protect data in transit, verify that your site uses HTTPS with SSL Check — a password hash sent over HTTP is interceptable and can be used directly (pass-the-hash).
An advanced concept: salting. Adding a unique random string (salt) to the password before hashing prevents attacks with rainbow tables (tables of pre-calculated hashes). Without salt, identical passwords produce identical hashes, allowing batch attacks. With a unique salt per user, every hash is different even for identical passwords, and rainbow tables become useless. All modern web frameworks handle salting automatically — if you implement hashing manually, always use a random salt of at least 16 bytes.