Hashing Explained: MD5, SHA-256 and Why a Hash Is Not Encryption
A hash function takes input of any size and produces a fixed-size fingerprint. Hashes are used for file verification, digital signatures and password storage, but they are often confused with encryption.
Key properties
- Deterministic: the same input always gives the same output.
- Fixed length: SHA-256 always yields 256 bits (64 hex characters), whether the input is one letter or a movie.
- Fast to compute in the forward direction.
- One-way: you cannot reconstruct the input from the hash.
- Avalanche effect: changing one character changes the entire output unpredictably.
- Collision resistant: it should be practically impossible to find two different inputs with the same hash.
Hashing vs encryption
Encryption is reversible with a key: you can decrypt to get the original. Hashing is not reversible. Use encryption when you need the data back, and hashing when you only need to check that something matches.
Common algorithms
- MD5 and SHA-1: broken for collision resistance. Practical attacks exist, so do not use them for security. MD5 is still used for quick non-security checksums.
- SHA-256 and SHA-512 (SHA-2 family): widely used and considered secure for integrity checks and signatures.
- SHA-3: a newer standard built on a different design.
Verifying downloads
Publishers often list a SHA-256 checksum next to a download. After downloading, compute the hash of your file and compare. If they match exactly, the file was not corrupted or altered. The checksum should come from a trusted page over HTTPS.
Passwords need special treatment
Plain SHA-256 is too fast for passwords: attackers can test billions of guesses per second on modern hardware. Store passwords with a purpose-built slow hash such as Argon2, bcrypt or scrypt, which include a unique random salt for each password. Never store passwords in plain text or reversible encryption, and never invent your own scheme.
Salts
A salt is random data added before hashing so identical passwords produce different hashes and precomputed lookup tables (rainbow tables) become useless.
HMAC
When you need to prove both integrity and authenticity, use an HMAC, which combines a hash with a secret key. It is used to sign API requests and webhooks.
What a generator is for
An online hash generator is handy for quickly checking a checksum or demonstrating how a small change alters the output. Do not paste real passwords or secrets into any website unless you trust it and know where processing occurs.
Summary
Hashes verify, encryption hides. Choose SHA-256 or better for integrity, and a slow, salted algorithm for passwords.
