What is a cryptographic hash?
A hash function takes any input — a word, a file, an entire book — and produces a fixed-length string of characters that acts as a unique fingerprint of that input. Change even one character in the input and the entire hash output changes completely. Hashing is one-way: you can't reverse a hash back into the original text.
MD5 vs SHA-1 vs SHA-256 — which should I use?
- MD5 (128-bit) is thoroughly broken — collisions can be generated in seconds. Only use it for legacy checksums or non-security deduplication.
- SHA-1 (160-bit) is also broken for security purposes — practical collision attacks exist. Only use it for legacy compatibility or non-security checksums.
- SHA-256 (256-bit) is the current standard for most use cases: file integrity checks, Git commit hashes, blockchain, and general-purpose security work.
Frequently asked questions
Is SHA-1 secure?
No. SHA-1 has known collision vulnerabilities (demonstrated publicly in 2017) and is deprecated for any security-sensitive use — digital signatures, certificates, password hashing. It's still fine for basic checksums where an attacker isn't actively trying to forge a match.
Can a hash be reversed or decrypted?
No — hashing is not encryption. There's no key and no reverse operation. The only way to "crack" a hash is to guess inputs and hash them until one matches (a brute-force or dictionary attack), which is why short, common inputs like passwords are risky to hash directly.
Is this tool safe for hashing passwords?
For learning or testing, yes. For a real production system, no — raw MD5/SHA-1/SHA-256 hashes of passwords are vulnerable to brute-force and rainbow-table attacks. Production systems should use a purpose-built password hash like bcrypt, scrypt, or Argon2, which add salting and deliberate slowness.
Does this tool store or transmit my text?
No. Hashing happens entirely in your browser via the Web Crypto API — your input never leaves your device.