MD5 and SHA-256 Hashes: What They Are and What They're For

A hash is a "fingerprint" of data. Take a file or string of any size, and you get back a string of fixed length. You can't reconstruct the original from the fingerprint, but you can instantly check that two files (or two passwords) are identical. Checksums, password storage, and digital signatures are all built on this.

The key property: one-way and exact

A hash function works in one direction only, and the tiniest change to the input completely changes the output. Here are real values for two similar strings:

MD5("test")  = 098f6bcd4621d373cade4e832627b4f6
MD5("test1") = 5a105e8b9d40e1329780d62ea2265d8a

Not a single character in common — that's the "avalanche effect." It's exactly why files are verified with hashes: if even one byte of a downloaded image changes, the checksum won't match.

Where hashes are used

• download checksums: a SHA-256 value is published next to ISO images and archives so you can verify integrity;
• password storage: the server keeps not the password but its hash (with a salt);
• deduplication and finding duplicate files;
• signatures and blockchain — hashes are what stitch blocks together there.

Which algorithm to choose

MD5 (128 bits) has long been "broken" for security purposes: finding collisions is a job of hours. It will still do for checking the integrity of a non-secret file, but no more than that. SHA-1 is officially banned for signatures after the practical attack of 2017. Today's workhorse is SHA-256: it's in the standards, in certificates, and supported everywhere. For password storage you don't want "fast" hashes at all but specially slow ones — bcrypt, scrypt, argon2 — whose cracking speed is deliberately throttled.

How to compute a hash online

In the MD5 generator and the SHA-256 generator, the computation happens in your browser via the Web Crypto API — the text is never sent anywhere. If you want all the algorithms at once, the multi-hash tool is more convenient: paste a string once and get MD5, SHA-1, and SHA-256 side by side. Verifying the hash of a downloaded file is now trivial: copy the value from the site's checksum and compare.