MD5, SHA-1 & SHA-256: Hashing Explained

Hashing shows up in checksums, password storage, and integrity checks — but it's often confused with encryption. Here's what a hash actually is and how the common algorithms compare.

What a hash function is

A hash function takes any input and produces a fixed-size fingerprint of it. The same input always yields the same hash, but even a one-character change produces a completely different output. Crucially, hashing is one-way: you cannot reverse a hash back to the original input.

Hashing is not encryption

This is the key distinction: encryption is reversible with a key; hashing is not reversible at all. A hash isn't "encrypted" and can't be "decrypted." That's exactly why hashes are used to verify data (does this fingerprint match?) rather than to hide and later recover it. See Security & Data Handling for how this fits the bigger picture.

How the common algorithms compare

MD5 — 128-bit, fast, but cryptographically broken. Fine for a quick non-security checksum; never use it for passwords or signatures.
SHA-1 — 160-bit, also broken for security use and being phased out.
SHA-256 — 256-bit, part of the SHA-2 family; the current sensible default for integrity and signatures.
SHA-512 — 512-bit SHA-2 variant; even larger output, often used where extra margin is wanted.

Common uses

File integrity — publish a SHA-256 checksum so downloaders can confirm a file wasn't corrupted or tampered with.
Deduplication — identical content produces identical hashes.
Password storage — done properly with a slow, salted algorithm (bcrypt, scrypt, Argon2), not a bare fast hash.

Part of the Encoding vs Encryption vs Hashing guide, which explains why hashing is one-way and how it differs from encoding and encryption. For hashing passwords specifically, see How to Store Passwords Securely.

Try it

Paste any text to generate its MD5, SHA-1, SHA-256 and SHA-512 hashes instantly — all computed in your browser, nothing uploaded.