Hash Generator — Complete Guide

Published August 2026 · 6 min read

What Is Hashing? (And How It Differs from Encryption)

A hash function takes any input — a word, a file, a whole hard drive — and produces a fixed-length string of characters, like b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9. The same input always produces the same output, and even a one-character change produces a completely different hash.

The key difference from encryption: hashing is one-way. Encryption is reversible if you have the key; a hash is mathematically designed so you can't work backward from the digest to the original input. You verify a hash by re-computing it, not by decrypting it.

MD5 vs SHA-1 vs SHA-256 vs SHA-512

These four algorithms are what most hash tools offer. Here's how they compare:

• MD5 — 128-bit output (32 hex chars), extremely fast, and cryptographically broken. Collisions (two different inputs with the same hash) are trivial to craft. Fine for non-security checksums, never for passwords.
• SHA-1 — 160-bit output (40 hex chars). Officially deprecated; Google demonstrated a real collision in 2017. Still seen in git and legacy systems, but avoid it for security.
• SHA-256 — 256-bit output (64 hex chars). Part of the SHA-2 family, widely considered secure, and the default in TLS, blockchain, and most modern tooling. This is your everyday choice.
• SHA-512 — 512-bit output (128 hex chars). Same family, larger digest. Slightly slower and longer, with no practical advantage over SHA-256 for most tasks.

See it for yourself — hashing hello world with each algorithm:

MD5    5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1  2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-512 309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f

Rainbow Tables and Salting

If a site stores SHA-256(password) and the database leaks, attackers can compare each hash against rainbow tables — precomputed hash lists for billions of common passwords, built once and reused forever. A weak password like "password123" is cracked in milliseconds.

The fix is salting: prepend a unique random value to the password before hashing, and store the salt next to the hash. Because every user gets a different salt, identical passwords produce different hashes, and precomputed tables become useless — each salt would need its own table. Modern password hashing goes further with deliberately slow algorithms (bcrypt, Argon2, scrypt) that make brute-force attacks expensive.

Which Hash Should You Use?

A simple rule of thumb covers most cases:

• File downloads, integrity checks, general tooling — SHA-256. It's fast, secure, and universally supported.
• Legacy compatibility — MD5 or SHA-1, only when you must match existing systems (and never for security).
• Passwords — none of the fast hashes. Use bcrypt, Argon2id, or scrypt, which are deliberately slow.
• API signatures — HMAC-SHA256, which adds a secret key so the digest can't be forged by anyone without it.

When in doubt, default to SHA-256. It's the safe, boring choice — and in security, boring is good. That's why our generator defaults to SHA-256 and shows the other algorithms as comparisons rather than recommendations.

Use Cases: Checksums, Passwords, and Integrity

Hashing powers a surprising amount of everyday software:

• File integrity — download a Linux ISO and verify its SHA-256 against the official one; if they match, the file is byte-for-byte correct. sha256sum file.iso does this in seconds.
• Password storage — good systems never store plaintext passwords. They store salted, slow hashes and compare on login.
• Content addressing — git commit IDs and Docker image digests are hashes of the content, so the identifier itself proves the content's integrity.
• Deduplication and indexing — hashing identical blobs lets systems detect duplicates without comparing contents.

Hashing in Code

Every mainstream language has hashing built in. Python:

import hashlib
text = b"hello world"
print(hashlib.sha256(text).hexdigest())
# b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

# Verify a downloaded file
import hashlib
h = hashlib.sha256()
with open("file.iso", "rb") as f:
    for chunk in iter(lambda: f.read(65536), b""):
        h.update(chunk)
print(h.hexdigest())

Or from the terminal with OpenSSL, no code at all:

echo -n "hello world" | openssl dgst -sha256

In the browser, the Web Crypto API provides crypto.subtle.digest() for SHA-256 and SHA-512 — useful for client-side checksums without sending data to a server:

const digest = await crypto.subtle.digest(
  'SHA-256', new TextEncoder().encode('hello world')
);
const hex = [...new Uint8Array(digest)]
  .map(b => b.toString(16).padStart(2, '0')).join('');
console.log(hex);

Try It Live

Need a hash right now? Our free Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 from any text instantly — entirely in your browser, so nothing is ever uploaded.

FAQ