Gearboxly
DeveloperSecurityExplainer

What Is a Hash Function? MD5, SHA-256 and Checksums Explained

By Gearboxly6 min read

You've seen hashes without knowing it — the long string next to a download labeled 'SHA-256', the way sites store passwords, the fingerprint on a digital signature. Hashing is one of the quiet workhorses of computing, and the idea behind it is simpler than it sounds.

Here's what a hash function is, what MD5 and SHA-256 actually do, and the one thing people most often get wrong about them.

What a hash function does

A hash function takes any input — a word, a file, a whole database — and produces a fixed-length string of characters called a hash (or digest). The same input always produces the same hash, but even a tiny change to the input produces a completely different one.

Crucially, it's one-way: you can go from input to hash instantly, but you can't reverse a hash back into the original input. That one-way property is what makes hashing useful.

Hashing is NOT encryption

This is the big misconception. Encryption is two-way — you scramble data with a key and unscramble it later. Hashing is one-way — there's no key and no 'unhashing.' You don't hash something to hide it and read it back; you hash it to *verify* it or *fingerprint* it. If you need to protect data and recover it, that's encryption's job, not hashing's.

MD5 vs SHA-256

  • MD5 — fast and produces a short hash, but it's cryptographically broken: attackers can craft two different inputs with the same hash. It's fine as a quick non-security checksum, but never for passwords or signatures.
  • SHA-256 — part of the SHA-2 family, longer and secure. It's the modern default for integrity checks, digital signatures and blockchain.

Rule of thumb: use SHA-256 for anything that matters; treat MD5 as a legacy checksum only.

Where hashing is used

  • Password storage — sites store the hash of your password, not the password itself, so a breach doesn't hand over plain passwords (good ones also add a 'salt').
  • File integrity — a checksum next to a download lets you confirm the file wasn't corrupted or tampered with.
  • Digital signatures & certificates — hashing is the fingerprint that signatures are built on.
  • Deduplication & caching — systems use hashes as quick, unique IDs for content.

Generate a hash yourself

Try it with the free Hash Generator — type any text and get its MD5, SHA-1 and SHA-256 hashes instantly, computed in your browser. Change a single character and watch the whole hash change.

Hash GeneratorCreate SHA-1, SHA-256, SHA-384 and SHA-512 hashes.

Need to actually protect and recover text? That's encryption, not hashing — use the Text Encryptor with a password instead.

Tools mentioned in this post

Frequently asked questions

A one-way function that turns any input into a fixed-length string (a hash). The same input always gives the same hash, but you can't reverse a hash back to the input.

No. Encryption is two-way (scramble and unscramble with a key); hashing is one-way with no way back. Hashing verifies and fingerprints; encryption protects and recovers.

Not for security. MD5 is cryptographically broken and should only be used as a basic non-security checksum. Use SHA-256 for anything important.

So a database breach doesn't expose the actual passwords — only their hashes, which can't be reversed. Good systems also add a unique salt to each one.

A hash of a file used to verify it downloaded or transferred without corruption or tampering — you compare the hash you compute to the one provided.

Keep reading