Understanding Cryptographic Hashes
A hash function takes an arbitrary input and returns a fixed-size string that uniquely identifies it. Change a single bit and the hash changes completely.
1. Algorithm Reference
The five algorithms represent the most common choices you will encounter:
- MD5: 128-bit output, broken for security, use only for legacy checksums
- SHA-1: 160-bit output, deprecated, git still uses internally
- SHA-256: 256-bit output, current default for TLS, JWTs, file checksums
- SHA-384: 384-bit output, SHA-2 variant for higher security needs
- SHA-512: 512-bit output, strongest SHA-2, faster on 64-bit hardware
2. Cryptographic vs Non-Cryptographic
Cryptographic hashes (MD5, SHA-1/256/384/512) are designed so attackers cannot find collisions or reverse the function. Non-cryptographic hashes (CRC32, MurmurHash, xxHash) trade security for speed in hash tables and bloom filters.
For file integrity, always use SHA-256 or stronger. For passwords, use bcrypt, scrypt, or Argon2 — never plain hash functions.
3. Real-World Use Cases
- File integrity: Linux distros publish SHA-256 sums alongside ISOs
- Git commit IDs: SHA-1 of commit content plus parent and tree
- Blockchain: Bitcoin mining is brute-forcing SHA-256 below a target threshold
- TLS certificates: SHA-256 digest signed by issuer's private key
- JWTs and API tokens: Hash payload with secret for tamper detection
4. Common Mistakes
- Displaying the digest without the algorithm prefix — a 32-char hex could be MD5 or truncated SHA-512
- Hashing formatted text instead of raw bytes — JSON with and without trailing newline hash differently
- Using plain SHA-256 for passwords — attackers with GPUs compute billions per second; use a slow KDF
- Comparing hashes with string equality instead of constant-time comparison
5. When to Choose Each Algorithm
Use MD5 for legacy compatibility and cache keys only. Use SHA-1 only where required (git internals). Use SHA-256 as the default for TLS, JWTs, signed software, and file checksums. Use SHA-384 when you need a balance of speed and security. Use SHA-512 when you need extra margin against future cryptanalysis or are on 64-bit hardware.
Hash Anything, Right in Your Browser
Done right, the whole operation takes seconds, runs entirely in your browser, and never uploads a byte of your input. For understanding Cryptographic Hashes — or anywhere a precise, in-browser result beats a heavier install — this tool is the right one.