Which hash algorithm should I use — MD5, SHA-1, or SHA-256?

MD5 and SHA-1 are cryptographically broken and should never be used for security-sensitive purposes. SHA-256 is the current default for virtually all new development. SHA-512 offers a wider security margin for high-assurance systems.

Hash Generator | Generate MD5, SHA-1, SHA-256 & SHA-512 Hashes

Algorithm	Output	Digest Length	Typical Use Cases	Security Status
MD5	128 bits	32 hex / 24 Base64	Legacy checksums, non-security deduplication	Broken — Avoid
SHA-1	160 bits	40 hex / 28 Base64	Legacy systems, Git object IDs	Broken — Avoid
SHA-256	256 bits	64 hex / 44 Base64	TLS, code signing, Bitcoin, general-purpose	Secure ✓
SHA-384	384 bits	96 hex / 64 Base64	Government compliance, high-assurance systems	Secure ✓
SHA-512	512 bits	128 hex / 88 Base64	File integrity, high-security applications	Secure ✓

Frequently Asked Questions

What is a cryptographic hash function and why does it matter?

A cryptographic hash function takes any input — a single character, a sentence, a 10 GB video file, an entire database export — and deterministically produces a fixed-length fingerprint called a hash or digest. The two defining properties are one-way irreversibility (you cannot reverse a hash back to the original input without exhaustive brute force) and avalanche behaviour (changing even a single bit in the input produces a completely different output). These properties make hash functions the foundation of data integrity verification, digital signatures, certificate pinning, Subresource Integrity checks, package manager verification, and file deduplication systems.

In everyday practice, hash functions answer one fundamental question with certainty: "Are these two things identical?" Because identical inputs always produce identical outputs, and different inputs produce different outputs with astronomically high probability, comparing two hash values is sufficient to confirm that two files, database records, or message payloads are byte-for-byte equal — or detect that they differ — without transmitting or comparing the full content. This is why software vendors publish SHA-256 checksums alongside download links, why Git identifies every commit and file by its SHA-1 hash, and why TLS certificates include signature hashes that browsers verify before trusting a connection.

MD5 vs SHA-1 vs SHA-256 — which algorithm should I actually use?

The answer depends entirely on whether your use case has any security implications. MD5 (128-bit output) and SHA-1 (160-bit output) are both cryptographically broken: practical collision attacks — where two completely different inputs produce the same hash — have been demonstrated on commodity hardware. For MD5, chosen-prefix collision attacks can construct two different PDF documents with identical MD5 hashes, enabling real forgery scenarios. For SHA-1, the SHAttered attack published in 2017 demonstrated a practical collision for the first time. Neither should be used for digital signatures, certificate validation, HMAC authentication, password hashing, or any context where an adversary might benefit from finding collisions or preimages.

SHA-256 is the correct default for virtually all new development. It powers TLS certificates, Bitcoin transaction IDs, code-signing manifests, and the integrity attributes in HTML <script> and <link> tags. SHA-384 and SHA-512 produce larger digests with a wider security margin; SHA-384 in particular satisfies NIST Suite B and many government compliance frameworks. For most developers, SHA-256 is the right choice and SHA-512 is the right choice when you need maximum collision resistance. The Algorithm Reference table on this page summarises all five algorithms with their output sizes, typical use cases and current security status at a glance.

Is it safe to use this tool with sensitive data?

Yes. Every hash calculation on this page runs exclusively inside your browser tab using the browser's built-in Web Crypto API (crypto.subtle.digest). No data leaves your device — not the text you type, not the file you upload, not any intermediate result. You can confirm this independently by opening your browser's Developer Tools, navigating to the Network tab, and watching the network activity while you hash text or a file: the request log stays empty after the initial page load. The tool also functions fully offline once the page has loaded, making it suitable for sensitive environments where network access is restricted or monitored.

The only exception is the pure-JavaScript MD5 implementation, which runs locally in the same browser context with the same zero-network guarantee — the Web Crypto API does not support MD5 natively because MD5 is broken, so the tool implements it in JS. For equally private password strength analysis, our Password Strength Checker applies the same architecture. For generating secure random passwords to hash, our Password Generator uses crypto.getRandomValues() in the same client-side fashion.

How do I verify a downloaded file's integrity using a SHA-256 checksum?

Switch to the Hash File tab on this page, drag your downloaded file into the upload zone or click to browse, ensure SHA-256 is checked in the algorithm grid, and click Hash This File. The result appears in the dark output panel within seconds. Copy the generated hash and compare it character-for-character against the checksum published on the vendor's download page, release notes, or signed manifest file. Even a single corrupted byte — from a partial download failure, a man-in-the-middle interception attempt, or silent disk corruption — changes the entire 64-character SHA-256 output completely, making it immediately obvious that the file is not what the vendor intended.

This technique is standard practice when downloading operating system ISO images (Ubuntu, Fedora, Tails, Kali), firmware updates for routers and embedded devices, software installers distributed outside a trusted package manager, and cryptographic key material. The Compare tab on this page can automate the matching step — paste the hash you generated and the vendor's published hash into the two input fields for an instant verdict without manually scanning 64 characters. If the vendor publishes the checksum in Base64 format rather than hex, use our Base64 Encoder / Decoder to convert it to hex before comparing.

What is the difference between Hexadecimal, HEX UPPER and Base64 output?

All three formats represent exactly the same underlying byte sequence — they are different text encodings of the same data, not different hashes. Hexadecimal (lowercase) uses characters 0–9 and a–f, producing a string that is exactly twice the byte length of the digest: a 32-byte SHA-256 hash becomes 64 hex characters. HEX UPPER is identical but with capital letters — some compliance tools, Windows utilities and legacy systems expect or produce uppercase hex specifically. Base64 encodes every three bytes as four printable characters from a 64-character alphabet, producing a more compact result: SHA-256 becomes 44 Base64 characters, SHA-512 becomes 88. Base64 is the preferred format for embedding hashes in HTTP headers, JSON payloads, JWT tokens, and HTML integrity attributes because it avoids characters that need URL-encoding.

If you need to convert between hex and Base64 representations of the same hash — for example, a vendor publishes a Base64 checksum but your system expects hex — our Base64 Encoder / Decoder handles that transformation in one click. Always confirm you are comparing the same encoding before concluding two hashes are different; a SHA-256 hash in hex and the same hash in Base64 look completely different but represent identical data.

Why should you never use SHA-256 to store passwords in a database?

SHA-256 is engineered to be fast — a modern GPU can compute around ten billion SHA-256 hashes per second. That speed is catastrophic for password storage because it lets an attacker who obtains a leaked database try billions of guesses per second until they recover the original password behind each hash. A six-character lowercase password falls in milliseconds; a common twelve-character password using predictable words or substitutions falls within hours. Even a genuinely random sixteen-character password becomes vulnerable once hardware improves sufficiently, since the attacker's speed scales directly with computing power and the hash was never designed to resist it.

Password hashing requires a purpose-built slow function with a per-password random salt embedded: bcrypt, Argon2id, or scrypt. These algorithms are deliberately expensive to compute at a configurable cost factor, so an attacker's ten billion SHA-256 guesses per second become ten thousand bcrypt guesses per second at a typical cost factor of 12. Our Bcrypt Hash Generator produces correctly salted, production-ready bcrypt hashes, and the cost factor slider lets you calibrate the computational expense to your server's tolerance. The hashes it produces are safe to store directly in a user table. Always pair strong hashing with strong input — use our Password Generator to create the credentials your users log in with.

What is a hash collision and how does it affect security?

A hash collision occurs when two distinct inputs produce an identical output digest. Because hash functions map an infinite input space to a finite fixed-length output, collisions must mathematically exist — the question is how hard they are to find deliberately. For SHA-256, the search space is 2²⁵⁶: finding a collision by brute force would require more energy than the observable universe produces in billions of years, which is why SHA-256 is considered collision-resistant for all practical purposes. The security margin is so large that no theoretical weakness has been demonstrated.

MD5's 128-bit output space is vastly smaller, and researchers demonstrated chosen-prefix collision attacks in 2004 that allow constructing two different PDF documents with the same MD5 hash — a concrete forgery scenario with real-world consequences. SHA-1 crossed the same line in 2017 with the SHAttered attack, which produced two different PDF files sharing the same SHA-1 hash in approximately 6,500 CPU years of computation — expensive at the time but now within reach of well-funded adversaries. This is precisely why the Algorithm Reference table on this page marks both as "Broken — Avoid" and why certificate authorities stopped issuing SHA-1 signed certificates in 2017. Use SHA-256 or SHA-512 for all new work.

Can I hash large files like ISO images and disk backups?

Yes. The Hash File tab reads your file using the browser's FileReader API and passes the resulting ArrayBuffer directly to crypto.subtle.digest. The Web Crypto API processes the data locally in memory — it never establishes a network connection and is not constrained by server upload limits, request timeouts or file size restrictions. Files in the multi-gigabyte range will take a few seconds on a modern laptop as the browser works through the data, but will complete correctly. The animated progress bar activates while the computation runs so you can see that work is in progress.

After hashing, use the Compare tab to paste the vendor's published checksum alongside your result for an instant integrity verdict, rather than manually verifying a 64 or 128-character hash string character by character. For generating unique random identifiers to use as filenames, storage keys or tracking IDs in a file pipeline, our Secure Token Generator and UUID / GUID Generator produce cryptographically random values in the formats most commonly expected by storage systems and databases.

Why does hashing an empty string still produce a hash?

Hash functions accept zero-length input as a fully valid case — an empty string is simply a byte sequence of length zero. The SHA-256 of an empty string is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, and the MD5 of an empty string is always d41d8cd98f00b204e9800998ecf8427e. These values are published in the algorithm specifications, appear in every reference implementation test vector, and are known to every security researcher and tool author. They demonstrate a crucial principle: the output of a hash function is entirely determined by its input, and "no input" is itself a defined input with a defined output.

This has a direct implication for password storage: if a user submits an empty password or any other common credential and it is hashed with a raw hash function, the resulting hash is immediately recognisable from any published table of known hash values — before any brute-force guessing begins. A random per-password salt, embedded in the hash string by algorithms like bcrypt, ensures that even two users with identical passwords produce different stored hashes, defeating both lookup table attacks and the empty-string recognition problem simultaneously. Explore our Password Strength Checker to understand what makes a password difficult to attack in practice.

What is the difference between a hash, a checksum and a MAC?

All three produce fixed-length fingerprints of input data, but they serve different purposes and provide different security guarantees. A cryptographic hash function (SHA-256, SHA-512) is deterministic and keyless — anyone with the same input can verify the hash independently, which makes it ideal for public integrity verification like software download checksums. A simple checksum (CRC32, Adler-32) is designed purely for error detection, not security — it is trivially manipulated by an attacker who wants to make a tampered file pass a checksum check, and should never be used for security purposes.

A Message Authentication Code (MAC) — specifically an HMAC — combines a cryptographic hash with a secret key. Only someone who knows the key can produce or verify a valid HMAC, which provides both integrity and authenticity: it proves not only that the data has not changed but also that the person who produced the MAC knew the secret. HMACs are used in API request signing, JWT token verification, cookie integrity protection, and webhook payload authentication. This tool generates plain hashes without a key — for HMAC generation you would need to implement crypto.subtle.sign with the HMAC algorithm in your own code, using a secret key that only your application holds. Pair HMAC tokens with secure random keys from our Secure Token Generator.

Free Hash Generator

What This Hash Generator Does

Tips for Getting the Best Results