Developer
Hash Functions Explained: MD5, SHA-256 and Password Security
8 min read
Hashes are everywhere behind the scenes. They verify that a downloaded file matches its published fingerprint, they index content, they detect data corruption, and they protect passwords. Understanding them clears up a lot of confusion about what cryptography can — and cannot — do. This guide explains the idea, the common algorithms, and the huge difference between hashing and encryption.
What a hash is
A hash function takes any input — a word, a sentence, a 10 GB movie — and produces a fixed-length output called a digest. The rules that make it useful:
- Deterministic: the same input always produces the same digest.
- Fixed length: SHA-256 always outputs 256 bits, whatever the input size.
- One-way: given a digest, there is no practical way to reconstruct the input.
- Avalanche effect: changing a single bit of input changes roughly half the output.
Hashing vs. encryption
Encryption is reversible — you decrypt with a key. Hashing is designed to be irreversible — there is no 'unhash' function. That design is exactly what makes it safe for storing passwords: the system stores the digest, never the password.
Common algorithms and when they fit
| Algorithm | Output size | Use for | Avoid for |
|---|---|---|---|
| MD5 | 128-bit | Quick non-crypto checksums | Security (collisions found) |
| SHA-1 | 160-bit | Legacy compatibility | Security (deprecated) |
| SHA-256 | 256-bit | File verification, signatures, general security | — |
| SHA-512 | 512-bit | High-security contexts | — |
The story in one line: MD5 and SHA-1 were fine in their time, but researchers found ways to create collisions — two different inputs producing the same digest. Today, SHA-256 (part of the SHA-2 family) is the baseline for security use: file downloads, integrity checks, and building blocks of signatures.
Hashes for file verification
When you download software, the publisher often lists a checksum — an SHA-256 digest — next to the download link. You hash the downloaded file and compare: if the digests match, the file is byte-identical to what the publisher produced; a mismatch means a corrupt or tampered download. This catches both transmission errors and malicious modification.
Passwords: how hashing protects them
A responsible system never stores your password. It stores the digest, so even if a database leaks, attackers get hashes they cannot reverse. That is why length and randomness still matter: short, common passwords can be guessed by hashing every dictionary word and comparing digests (a dictionary or rainbow attack). Long random passwords are impractical to brute-force.
Generating hashes safely
Generating a hash requires nothing but the input — it is a pure computation. A browser-based hash generator computes MD5, SHA-1, SHA-256 or SHA-512 locally, which matters when the input is sensitive: a document hash, a confidential string, or an internal identifier never needs to cross the network to be checksummed.
Hash generator in Convrs
Convrs includes a hash generator supporting the MD5, SHA-1, SHA-256 and SHA-512 algorithms, running entirely in the browser. Type or paste your input, choose an algorithm, copy the digest. Nothing is transmitted — the computation stays in JavaScript/WASM on your device.