What Is a Hash? SHA-256, MD5, and Why Checksums Still Matter

You download a Linux ISO or a software package, and the website shows a long string of letters and numbers labeled "SHA-256". That is a hash — a digital fingerprint of the file. If even one bit of the file changes, the hash changes completely.

A hash generator creates these fingerprints from any text. You can use it to verify file integrity, compare two pieces of data without seeing the actual data, or generate cache keys.

How hash functions actually work

A hash function takes any input — one word or an entire hard drive — and produces a fixed-length output. SHA-256 always outputs 256 bits (64 hex characters). MD5 always outputs 128 bits (32 hex characters).

The key properties that make hashes useful:

• Deterministic: same input always produces the same hash.
• Avalanche effect: changing even one bit of input completely changes the output. "hello" and "Hello" produce completely different hashes.
• One-way: you cannot reverse a hash to get the original input. This is why "forgot password" exists instead of "show me my password."
• Collision resistance: (ideally) two different inputs should not produce the same hash.

SHA vs MD5: which one to use

SHA-256 is the current standard. It produces a 64-character hex string and has no known practical collisions. Use this for anything security-related: password hashing (with salt), digital signatures, certificate validation.

MD5 is faster but broken for security. Researchers have demonstrated practical collision attacks — two different PDFs with the same MD5 hash. Do not use MD5 for passwords or anything where someone might try to fake a match.

MD5 is still fine for non-security uses: cache invalidation keys, data integrity checksums (not authentication), deduplication, and quick "are these two files the same?" comparisons.

Our free hash generator supports SHA-1, SHA-256, SHA-384, SHA-512, and MD5. You can hash any text and compare two hashes side by side to see if they match. The comparison feature is useful for verifying file integrity — copy the expected hash from the website, paste your computed hash, and confirm they are identical.

Real-world hash uses

Password storage: websites do not store your actual password. They store a hash of it — specifically, a salted hash using bcrypt, scrypt, or Argon2. When you log in, they hash what you typed and compare. If the hashes match, the password was correct.

Git commits: Git uses SHA-1 hashes for every commit. The commit ID you see (8ed9bbb) is just the first 7 characters of the commit's hash. This is why changing a commit message changes the hash — and why rebasing creates new commits.

File download verification: major software projects publish checksums next to their downloads. After downloading, you compute the hash locally and compare. If they match, the file was not corrupted or tampered with during download. This is especially important for OS images, wallet software, and security tools.

We also have a dedicated MD5 generator if that is all you need.