MD5, SHA-256, and SHA-512: Understanding Cryptographic Hashes

Hash functions are everywhere in computing: verifying downloads, storing passwords safely, powering digital signatures, and indexing data. Understanding what they do, and which ones are still safe, is essential for any developer.

What Is a Hash Function?

A cryptographic hash function takes any input, from a single character to a huge file, and produces a fixed-length string called a digest. The same input always produces the same output, but even a one-character change produces a completely different digest.

Properties of a Good Hash Function

• Deterministic: the same input always yields the same hash.
• Fast to compute for any input size.
• Irreversible: you cannot feasibly recover the input from the hash.
• Collision-resistant: it is extremely hard to find two inputs with the same hash.
• Avalanche effect: a tiny input change drastically changes the output.

Comparing the Common Algorithms

• MD5: produces a 128-bit hash. Fast, but cryptographically broken. Use only for non-security checksums.
• SHA-1: 160-bit. Also considered broken for security and being phased out.
• SHA-256: 256-bit, part of the SHA-2 family. The current workhorse for integrity and security.
• SHA-512: 512-bit, also SHA-2. Stronger and often faster on 64-bit systems.

Common Use Cases

Hashes verify that a downloaded file was not corrupted or tampered with by comparing checksums. They power digital signatures and data deduplication. For passwords specifically, you should use a slow, salted algorithm like bcrypt or Argon2 rather than a raw fast hash.

Never use MD5 or SHA-1 for security-sensitive work. They are fine for quick integrity checks, but SHA-256 or SHA-512 should be your default for anything that matters.

The Hash Generator computes MD5, SHA-256, and SHA-512 digests instantly and locally in your browser, so your input is never transmitted anywhere.