What is a hash function?

A hash function takes input data of any size and produces a fixed-size output (hash/digest). The same input always produces the same hash, but even a tiny change in input produces a completely different hash.

Is MD5 still safe to use?

MD5 is considered cryptographically broken and should not be used for security purposes like password hashing. It's still acceptable for checksums and non-security purposes. For security, use SHA-256 or better.

Can you reverse a hash?

Hash functions are one-way by design. You cannot mathematically reverse a hash. However, common passwords can be found using rainbow tables. This is why password hashing uses salts and specialized algorithms like bcrypt.

Hash Generator (MD5, SHA-256)

Understanding Cryptographic Hash Functions

A cryptographic hash function transforms any input data into a fixed-size output called a digest or hash. These functions are fundamental to modern security, enabling password verification, data integrity checks, digital signatures, and blockchain technology. The key properties of a secure hash function include determinism (same input always produces the same output), speed, avalanche effect (small input changes cause dramatically different outputs), and one-way computation (impossible to reverse).

Hash Algorithm Comparison

Algorithm	Output Size	Security Status	Speed	Recommended Use
MD5	128 bits (32 hex)	Broken	Fastest	Legacy checksums only
SHA-1	160 bits (40 hex)	Deprecated	Fast	Legacy systems, Git
SHA-256	256 bits (64 hex)	Strong	Moderate	General purpose, certificates
SHA-384	384 bits (96 hex)	Strong	Moderate	Higher security requirements
SHA-512	512 bits (128 hex)	Strong	Fast on 64-bit	Maximum security
SHA-3	224-512 bits	Strong	Moderate	Post-quantum preparation
BLAKE2	256-512 bits	Strong	Fastest secure	Modern applications
BLAKE3	256 bits	Strong	Extremely fast	New projects

Common Use Cases

File Integrity Verification

When downloading software, ISOs, or important files, publishers provide checksums (usually SHA-256) that you can compare against your downloaded file. If the hashes match, you can be confident the file hasn't been corrupted during transfer or tampered with by attackers.

Password Storage

Storing passwords securely requires specialized hashing algorithms designed for this purpose. Never use raw SHA-256 or MD5 for passwords—use bcrypt, scrypt, or Argon2 instead. These algorithms are intentionally slow and include built-in salting, making brute-force attacks computationally expensive.

Data Deduplication

Hash functions enable efficient duplicate detection without comparing entire files. Cloud storage systems, backup software, and content-addressable storage use hashes as unique identifiers. If two files produce the same hash, they're almost certainly identical.

Digital Signatures and Certificates

SSL/TLS certificates, code signing, and document signatures use hashes. The document is hashed, and only the hash is encrypted with the private key. Recipients hash the document themselves and compare it to the decrypted signature, verifying both integrity and authenticity.

Blockchain and Cryptocurrencies

Every block in a blockchain contains the hash of the previous block, creating an immutable chain. Bitcoin uses double SHA-256, Ethereum uses Keccak-256. Any attempt to modify historical data would change all subsequent hashes, making tampering immediately detectable.

Cache Keys and ETags

Web servers generate ETags from content hashes for efficient caching. API responses can be cached using hashed request parameters as keys. This ensures cache hits only when the underlying data is truly identical.

Hash Security Levels

Security Level	Minimum Hash Size	Protects Against
Basic integrity	128 bits	Accidental corruption
Standard security	256 bits	Most attacks
High security	384+ bits	Nation-state adversaries
Quantum-resistant	384+ bits	Future quantum computers

Important Security Guidelines

1. Never use MD5 or SHA-1 for security - Both have known vulnerabilities. MD5 collisions can be generated in seconds; SHA-1 collisions have been demonstrated. Use them only for legacy compatibility or non-security checksums.

2. Always salt password hashes - A salt is random data added to each password before hashing. Without salts, attackers can use precomputed rainbow tables. Each user needs a unique salt stored alongside their hash.

3. Use password-specific algorithms - bcrypt, scrypt, and Argon2 are designed for password hashing with configurable work factors. They're intentionally slow and memory-hard, making GPU-based attacks impractical.

4. Match algorithm to use case - Use SHA-256 for general integrity, BLAKE3 for speed-critical applications, and SHA-3 for post-quantum preparation. Don't use cryptographic hashes where CRC32 suffices (error detection without security needs).

5. Verify hashes from trusted sources - When verifying downloads, ensure you obtain the expected hash from a trusted channel (HTTPS website, signed email) separate from the download itself.