Hash Generators: MD5, SHA-1, SHA-256 Explained
Understand cryptographic hash functions: MD5, SHA-1, and SHA-256. Learn how they work, their differences, security levels, and when to use each one.
What Is a Hash Function?
A cryptographic hash function is a mathematical algorithm that takes an input of any size and produces a fixed-length string of characters called a "hash" or "digest." Three key properties make hash functions useful:
- Deterministic: The same input always produces the same output.
- One-way: You cannot reverse a hash to recover the original data.
- Avalanche effect: A tiny change in input (even one bit) produces a completely different hash.
Hash functions are used everywhere in computing: file integrity verification, digital signatures, password storage, blockchain, and data deduplication.
MD5: Fast but Broken
MD5 (Message Digest Algorithm 5) produces a 128-bit (32 hexadecimal character) hash. Designed by Ronald Rivest in 1991, it was once the most widely used hash function.
MD5 has been considered cryptographically broken since 2004, when researchers demonstrated practical collision attacks — the ability to produce two different inputs with the same hash. By 2008, researchers could create fraudulent SSL certificates using MD5 collisions.
Security warning: Do not use MD5 for password hashing, digital signatures, or any security-critical application. Use it only for non-security checksums like file deduplication.
SHA-1: Deprecated for Security
SHA-1 (Secure Hash Algorithm 1) produces a 160-bit (40 hexadecimal character) hash. It was designed by the NSA and published in 1995. For many years, it was the standard for digital signatures and TLS certificates.
In 2017, Google and CWI Amsterdam demonstrated the first practical SHA-1 collision attack (called "SHAttered"). All major browsers and certificate authorities have since deprecated SHA-1. Git, however, still uses SHA-1 for commit hashing, though efforts to migrate to SHA-256 are underway.
SHA-256: The Modern Standard
SHA-256 is part of the SHA-2 family, also designed by the NSA and published in 2001. It produces a 256-bit (64 hexadecimal character) hash and is currently the most widely recommended hash function for security applications.
SHA-256 is used in TLS/SSL certificates, Bitcoin's proof-of-work algorithm, digital signatures, and file integrity verification. No practical collision attacks have been demonstrated against SHA-256, and it is considered secure for the foreseeable future.
Algorithm Comparison
| Property | MD5 | SHA-1 | SHA-256 |
|---|---|---|---|
| Output length | 128 bits | 160 bits | 256 bits |
| Hash length (hex) | 32 chars | 40 chars | 64 chars |
| Speed | Fastest | Fast | Moderate |
| Collision resistance | Broken | Deprecated | Secure |
| Recommended for security | No | No | Yes |
When to Use Each Algorithm
- File checksums (non-security): MD5 is fine for quick file deduplication or integrity checks where security is not a concern.
- Digital signatures and certificates: Use SHA-256 or SHA-3.
- Password storage: Do not use any raw hash function. Use bcrypt, Argon2, or PBKDF2 with a salt.
- Blockchain and proof-of-work: SHA-256 is the standard.
- Git commit hashing: Currently SHA-1, migrating to SHA-256.
Try it now: Open the Hash Generator Tool →
Generate MD5, SHA-1, and SHA-256 hashes for any text instantly.
Frequently Asked Questions
What is a cryptographic hash function?
A cryptographic hash function is a mathematical algorithm that takes an input of any size and produces a fixed-length string of characters (the hash). It is designed to be one-way: you cannot reverse a hash to get the original input.
Is MD5 still secure?
No. MD5 has been considered cryptographically broken since 2004 when collision attacks were demonstrated. It should not be used for security purposes like password hashing or digital signatures. It can still be used for non-security checksums.
Which hash algorithm should I use?
For security-critical applications, use SHA-256 or SHA-3. For password hashing, use bcrypt or Argon2 instead of raw SHA-256. For simple checksums where security is not a concern, MD5 or SHA-1 are acceptable.