You've seen hashes without knowing it — the long string next to a download labeled 'SHA-256', the way sites store passwords, the fingerprint on a digital signature. Hashing is one of the quiet workhorses of computing, and the idea behind it is simpler than it sounds.
Here's what a hash function is, what MD5 and SHA-256 actually do, and the one thing people most often get wrong about them.
What a hash function does
A hash function takes any input — a word, a file, a whole database — and produces a fixed-length string of characters called a hash (or digest). The same input always produces the same hash, but even a tiny change to the input produces a completely different one.
Crucially, it's one-way: you can go from input to hash instantly, but you can't reverse a hash back into the original input. That one-way property is what makes hashing useful.
Hashing is NOT encryption
This is the big misconception. Encryption is two-way — you scramble data with a key and unscramble it later. Hashing is one-way — there's no key and no 'unhashing.' You don't hash something to hide it and read it back; you hash it to *verify* it or *fingerprint* it. If you need to protect data and recover it, that's encryption's job, not hashing's.
MD5 vs SHA-256
- MD5 — fast and produces a short hash, but it's cryptographically broken: attackers can craft two different inputs with the same hash. It's fine as a quick non-security checksum, but never for passwords or signatures.
- SHA-256 — part of the SHA-2 family, longer and secure. It's the modern default for integrity checks, digital signatures and blockchain.
Rule of thumb: use SHA-256 for anything that matters; treat MD5 as a legacy checksum only.
Where hashing is used
- Password storage — sites store the hash of your password, not the password itself, so a breach doesn't hand over plain passwords (good ones also add a 'salt').
- File integrity — a checksum next to a download lets you confirm the file wasn't corrupted or tampered with.
- Digital signatures & certificates — hashing is the fingerprint that signatures are built on.
- Deduplication & caching — systems use hashes as quick, unique IDs for content.
Generate a hash yourself
Try it with the free Hash Generator — type any text and get its MD5, SHA-1 and SHA-256 hashes instantly, computed in your browser. Change a single character and watch the whole hash change.
Hash GeneratorCreate SHA-1, SHA-256, SHA-384 and SHA-512 hashes.Need to actually protect and recover text? That's encryption, not hashing — use the Text Encryptor with a password instead.