If you spend any time around databases, web security, or software development, you have definitely run into the word hashing. It is one of those concepts that sounds super academic and complicated, but it is actually the backbone of the entire modern internet. Hashing is what keeps your passwords safe when a database gets leaked. It is what guarantees that the file you just downloaded is actually the file you wanted, and not a piece of malware injected by a hacker.
But what is a cryptographic hash, and how does it actually work?
In this guide, we are going to break down the mechanics of cryptographic hashes in plain English. We will compare the most common algorithms (MD5, SHA-1, SHA-256, and SHA-512), look at how to generate them in different programming languages, and explain why keeping your hashing local is a big deal for your privacy.
What is a cryptographic hash anyway?
At its core, a cryptographic hash function is a mathematical algorithm. It takes any input (a single letter, a password, a sentence, or even a five gigabyte movie file) and crushes it down into a fixed-size string of characters. This output string is usually represented in hexadecimal format, which is just a mix of numbers (0-9) and letters (a-f).
No matter how big the input is, the output is always the same length. For example, if you run the word cat through a SHA-256 hash function, you get a 64-character string. If you run the entire text of the Encyclopedia Britannica through SHA-256, you also get a 64-character string.
Think of it like a digital fingerprint. Just like a human fingerprint can uniquely identify you without revealing your height, weight, or eye color, a hash uniquely identifies a piece of data without revealing the data itself.
Hashing vs encryption: What is the difference?
This is a classic point of confusion. Many people use the terms hashing and encryption interchangeably, but they are completely different processes used for different jobs.
Here is the difference:
- Encryption is a two-way street. You take a piece of text, encrypt it using a secret key, and get scrambled text (ciphertext). Later, someone else with the correct key can decrypt the ciphertext back into the original plain text. The goal is confidentiality during transport.
- Hashing is a one-way street. You take a piece of text, run it through a hash function, and get a hash. You cannot go backwards. There is no key that will decrypt a hash back into the original text. It is mathematically designed to be impossible to reverse. The goal is integrity and verification.
If you hash a password, you cannot recover it.
So how does login work? When you sign up, the website hashes your password and stores the hash in the database. When you log in later, the site hashes the password you just entered and compares it to the stored hash. If the hashes match, you are in. If a hacker steals the database, they only get a list of useless hashes, not your actual passwords.
What properties make a hash function secure?
To be useful for computer security, a hash function has to follow a very strict set of rules. A standard mathematical function won’t cut it. It must have these five properties:
1. It must be deterministic
This means that if you feed the same input into a hash function today, tomorrow, or ten years from now, you will get the exact same output every single time. If the hash changed randomly, we could never use it for verification.
2. It must be fast to compute
A computer should be able to calculate the hash of a string or file almost instantly. If it took ten seconds to hash a password, logging into a website would feel painfully slow.
3. It must be one-way (Pre-image resistant)
It should be practically impossible to look at a hash and figure out the original input string. The only way to find the input should be guessing (brute force), which takes too long if the input is complex.
4. It must have the avalanche effect
This is where it gets cool. A tiny change in the input must completely alter the output hash.
If you hash Hello World and then hash hello World (just changing a single capital letter), the two hashes must look entirely different. There should be no pattern that links them together.
5. It must be collision resistant
A collision happens when two completely different inputs produce the exact same output hash.
Since there are an infinite number of possible inputs but a finite number of possible output hashes, collisions must mathematically exist. However, a secure algorithm makes it so difficult to find a collision that it would take a supercomputer millions of years of searching.
Let us compare the popular hashing algorithms: MD5, SHA-1, SHA-256, and SHA-512
Over the years, cryptographers have designed many different hashing functions. Some have stood the test of time, while others have been broken and discarded. Let us look at the four most common algorithms you will run into.
What is MD5 and is it still secure?
MD5 (Message Digest 5) was designed in 1991. It produces a 128-bit hash, which is represented as a 32-character hexadecimal string.
For a long time, MD5 was the industry standard. It was used for everything from storing passwords to verifying files.
Today, MD5 is completely broken.
Researchers have found ways to generate collisions in seconds on normal laptops. This means an attacker can create two different files (like a harmless image and a piece of malware) that produce the exact same MD5 hash.
Because of this, MD5 should never be used for security purposes. However, it is still used for non-secure tasks, like checking if a file transfer completed without errors (checksums) or indexing database rows.
What is SHA-1 and why did Git use it?
SHA-1 (Secure Hash Algorithm 1) was designed by the NSA and published in 1995. It produces a 160-bit hash (40 hex characters).
For years, SHA-1 was the standard for SSL certificates and secure web traffic.
Like MD5, SHA-1 is now deprecated and considered insecure.
In 2017, researchers at Google announced the SHAttered attack, where they successfully generated a collision for two different PDF documents.
Git historically used SHA-1 to identify commits and file states. While Git is slowly transitioning to SHA-256, it still relies on SHA-1 for compatibility because Git uses hashes for integrity (detecting accidental corruption), not as a security barrier against targeted attacks.
What is SHA-256 and why does Bitcoin love it?
SHA-256 is part of the SHA-2 family, designed by the NSA and published in 2001. It produces a 256-bit hash (64 hex characters).
Currently, SHA-256 is the industry standard for cryptographic security.
It has no known practical attacks or collisions. It is used to secure SSL/TLS connections, sign digital certificates, and verify package downloads in Linux package managers.
It is also the foundation of the Bitcoin network. Bitcoin miners run millions of SHA-256 hashes every second to secure transactions and mint new coins. If you need a secure, reliable hash function today, SHA-256 is your default choice.
What is SHA-512 and when should you use it?
SHA-512 is the big brother of SHA-256. It produces a 512-bit hash (128 hex characters).
It offers the highest level of security in the SHA-2 family.
Interestingly, on 64-bit hardware (which is what almost all modern servers and laptops run), SHA-512 can actually run faster than SHA-256. This is because SHA-512 operates on 64-bit words, while SHA-256 operates on 32-bit words.
If you are hashing massive amounts of data on modern servers and need maximum security, SHA-512 is an excellent choice.
How to generate a cryptographic hash in JavaScript?
If you are building a web application, you do not need to install heavy external libraries to generate hashes. Modern browsers have built-in support for cryptography via the Web Crypto API.
Here is a helper function that takes a text string and generates a SHA-256 hash using native browser APIs:
async function generateSHA256(message) {
const encoder = new TextEncoder();
const data = encoder.encode(message);
const hashBuffer = await window.crypto.subtle.digest('SHA-256', data);
const hashArray = Array.from(new Uint8Array(hashBuffer));
const hashHex = hashArray.map(byte => byte.toString(16).padStart(2, '0')).join('');
return hashHex;
}
generateSHA256("hello").then(hash => {
console.log("SHA-256 Hash:", hash);
});The Web Crypto API is incredibly fast because it is implemented natively in the browser engine. It also supports SHA-1, SHA-384, and SHA-512.
How to generate hashes in Python?
Python has a built-in library called hashlib that provides access to many different hashing algorithms.
Here is how you can generate MD5, SHA-256, and SHA-512 hashes in Python:
import hashlib
message = "hello"
message_bytes = message.encode('utf-8')
# Generate SHA-256 hash
sha256_hash = hashlib.sha256(message_bytes).hexdigest()
print("SHA-256:", sha256_hash)
# Generate MD5 hash
md5_hash = hashlib.md5(message_bytes).hexdigest()
print("MD5:", md5_hash)
# Generate SHA-512 hash
sha512_hash = hashlib.sha512(message_bytes).hexdigest()
print("SHA-512:", sha512_hash)If you are hashing files instead of strings, you should read the file in chunks to avoid running out of memory:
import hashlib
def hash_file(filepath):
sha256_algo = hashlib.sha256()
with open(filepath, 'rb') as f:
while True:
chunk = f.read(65536)
if not chunk:
break
sha256_algo.update(chunk)
return sha256_algo.hexdigest()How to generate hashes in Bash using command line tools?
If you are working in a terminal on Linux or macOS, you can generate hashes instantly without writing any code. Almost all Unix systems come with hashing utilities pre-installed.
To generate a SHA-256 hash of a string:
echo -n "hello" | sha256sumNote that the -n flag is very important. It tells the echo command not to add a newline character to the end of the string. If you forget -n, the hash will be completely different because it will include the newline!
To check the SHA-256 hash of a downloaded file:
sha256sum downloaded-file.zipOn macOS, the commands are slightly different. Instead of sha256sum, use shasum -a 256:
echo -n "hello" | shasum -a 256For MD5, you can use md5sum on Linux or md5 on macOS.
What is the difference between hashing a string and hashing a file?
When you run a file through a hash generator, the tool is not hashing the file name, the file extension, or the date the file was created. It is hashing the raw binary bytes that make up the file content.
This has a few interesting consequences:
- If you rename
photo.jpgtoholiday.jpg, the hash of the file remains exactly the same, because the pixels inside the image did not change. - If you open a text file, add a single space character, and save it, the hash will completely change due to the avalanche effect.
- If you copy a file to a flash drive, the copy will have the exact same hash as the original, making hashing the perfect tool to verify that a file was not corrupted during copying.
Why did we build the TextSorter Cryptographic Hash Generator?
If you need to quickly check the hash of an API key, verify a file download checksum, or generate a signature for a webhook, writing scripts or opening terminal windows is a hassle. You just want a clean online tool.
However, using online hash generators can be dangerous.
When you paste an API key, a password, or customer data into a random hashing website, that data is often sent to their server. If the website is compromised, or if they keep server logs of all inputs, your private keys and strings are exposed to the world.
That is why we built the TextSorter Hash Generator.
Our tool works entirely in your browser using JavaScript and the native Web Crypto API. When you paste your text, the hashes are calculated locally on your machine. Your input string never leaves your computer. No data is sent to a server, and nothing is logged. It is 100% private and secure.
We also designed it to save you time by:
- Calculating MD5, SHA-1, SHA-256, and SHA-512 hashes simultaneously in real time.
- Letting you switch between lowercase and uppercase hex outputs with a single click.
- Providing a clean, simple layout with zero slow ads.
Give it a try at the TextSorter Hash Generator next time you need to generate or verify a checksum.
FAQs about cryptographic hashes
Can you decrypt a SHA-256 hash?
No. Hashing is a one-way mathematical function. There is no decryption key. The only way to find the original input is to guess it (brute force) or use a pre-calculated table of known hashes (a rainbow table).
What is a rainbow table?
A rainbow table is a pre-computed database of strings and their corresponding hashes. Attackers use them to quickly look up common passwords from stolen hashes. To prevent this, systems use a salt, which is a random string added to the password before hashing it, making rainbow tables useless.
Why do some files have MD5 and SHA-256 checksums listed next to them?
Software developers list checksums so you can verify that the file you downloaded was not corrupted or modified by a third party. Once the download finishes, you calculate the file hash on your machine and compare it to the listed checksum. If they match, the file is safe to open.
What is the difference between SHA-2 and SHA-3?
SHA-2 is the current industry standard (which includes SHA-256 and SHA-512). SHA-3 is a newer family of hash functions released by NIST in 2015. While SHA-3 uses a different mathematical structure and is highly secure, SHA-2 remains the most widely supported and is still considered completely secure.