Hash functions are one-way mathematical transformations: they take input of any size and produce a fixed-size digest. The same input always produces the same digest; even a single-character change produces a completely different one.
MD5 — fast, but broken for security
MD5 produces a 128-bit (32 hex character) digest. Collisions (two different inputs with the same hash) can be engineered, making it unsuitable for security purposes. Still fine for checksums and non-security deduplication where speed matters.
SHA-1 — deprecated
SHA-1 (160-bit) was widely used for TLS certificates and Git object IDs. Practical collision attacks were demonstrated in 2017. Avoid for any new security-sensitive use.
SHA-256 / SHA-512 — the current standard
Part of the SHA-2 family. SHA-256 produces a 256-bit digest; SHA-512 produces 512 bits. No known practical attacks. Use these for digital signatures, HMAC, and data integrity.
SHA-3 — the alternative standard
A fundamentally different construction (Keccak sponge) standardised in 2015. Equally secure to SHA-2 and a good alternative if you want defence-in-depth against algorithm-specific weaknesses.
Never use hashing alone for passwords
Raw hashes are vulnerable to rainbow tables. Always use a password-specific KDF: bcrypt, scrypt, or Argon2. These are intentionally slow and incorporate salting.
Quick reference
- File integrity check → SHA-256
- HMAC / API signing → SHA-256
- Password storage → bcrypt / Argon2
- Non-security dedup / cache keys → MD5 or SHA-1 (speed wins)
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes in your browser with ByteForge's Hash Generator.