A hash function turns any input into a fixed-size fingerprint. The same input always produces the same output, a tiny change produces a completely different one, and there is no practical way to run it backwards. Which algorithm you pick depends entirely on what you are protecting.
What a good hash provides
- Determinism: the same input always gives the same hash.
- Preimage resistance: given a hash, you can't feasibly find an input that produces it.
- Collision resistance: you can't feasibly find two different inputs with the same hash.
- Avalanche effect: changing one bit of input changes about half the bits of the output.
MD5 and SHA-1: broken for security
Collisions are practical for MD5 (demonstrated in 2004) and for SHA-1 (the public SHAttered attack in 2017). That means an attacker can craft two different files with the same hash, which breaks their use in digital signatures and certificates. Both are still fine for detecting accidental corruption, such as checking that a download wasn't truncated, but not for anything an attacker could manipulate.
SHA-256: the sensible default
SHA-256, part of the SHA-2 family, has no known practical collision or preimage attacks. It is used across TLS, code signing, package managers, and blockchains. For a checksum published beside a download, or any general-purpose fingerprint, SHA-256 is the safe choice.
Passwords need a different kind of hash
Fast hashes are a liability for passwords, because an attacker with a stolen database can test billions of guesses per second on a GPU. Password hashing should be deliberately slow and salted (a unique random value per password):
- Argon2id is the current recommendation for new systems.
- bcrypt is battle-tested and widely available (note it only uses the first 72 bytes of input).
- scrypt and PBKDF2 are acceptable alternatives when configured with high work factors.
- Plain MD5, SHA-1, or unsalted SHA-256 should never be used to store passwords.
Which hash for which job
- Verifying a file wasn't corrupted: SHA-256 (MD5 is acceptable if it's all that's published).
- Verifying that a message is authentic and untampered: HMAC-SHA256 with a secret key.
- Storing user passwords: Argon2id or bcrypt.
- Deduplicating files or cache keys where attackers aren't involved: any fast hash, including MD5.
- Anything security-sensitive: avoid MD5 and SHA-1.
Hashing is not encryption
A hash can't be reversed to recover the input, but short or predictable inputs can be guessed and checked. Salting and slow algorithms exist to make that guessing expensive.
Verifying a download step by step
- Download the file and copy the checksum published by the vendor, ideally from a separate, trusted page.
- Compute the same algorithm's hash of your downloaded file.
- Compare the two values character by character. Any difference means the file is corrupt or was altered.
Frequently asked questions
Is MD5 still safe to use?
Not for security. Collisions are easy to produce. It's acceptable only for non-adversarial checks such as detecting accidental corruption or generating cache keys.
Is SHA-256 better than MD5?
Yes for security purposes. SHA-256 has no known practical collisions, whereas MD5 has been broken for years.
Can a hash be reversed or decrypted?
Not directly. Hashes are one-way, but weak or common inputs can be found by guessing and comparing, which is why password hashes need salts and slow algorithms.
What should I use to hash passwords?
Argon2id or bcrypt with a unique salt per password, not a fast general-purpose hash like MD5 or SHA-256.
Try it: Hash Generator — free, runs in your browser, nothing is uploaded.
Originally published at ilovekit.app.
