Why are MD5 and SHA-1 considered insecure for security use?

Both MD5 and SHA-1 suffer from proven cryptographic collision vulnerabilities, where attackers can craft two distinct inputs that produce the identical hash digest. In 2004, practical collision attacks against MD5 were published, and in 2017 Google demonstrated the SHAttered collision attack against SHA-1. Today, they are acceptable only for non-security checksums (such as checking if a downloaded file was corrupted in transit), but forbidden for digital signatures or certificates.

What is the difference between hashing and encryption?

Hashing is a one-way function designed to produce a fixed-size fingerprint that cannot be decrypted back into the original plaintext. Encryption is a two-way function designed to scramble data so that only authorized parties possessing the corresponding cryptographic key can decrypt and read the original message.

How does HMAC (Hash-based Message Authentication Code) work?

An HMAC combines a cryptographic hash function (such as SHA-256) with a secret pre-shared key. It verifies both the data integrity of a message and the authenticity of the sender, ensuring that only a party with the shared secret could have created the matching signature. HMACs are widely used in webhooks (e.g. Stripe, GitHub) and API request signing (AWS Signature Version 4).

Can a SHA-256 hash be reversed or cracked?

No. A SHA-256 hash cannot be mathematically reversed because information is irreversibly compressed into 256 bits. However, weak or common passwords hashed without salt can be cracked using precomputed rainbow tables or dictionary attacks. This is why password storage requires salted, computationally expensive key derivation functions like Argon2id or bcrypt rather than raw fast hashes.

Is it safe to compute hashes of sensitive files with this tool?

Yes. All hashing and checksum calculations occur strictly inside your local browser memory using the native Web Crypto API. Neither your plaintext nor your files are ever transmitted across the internet to our servers.

Utility #22Web Crypto API

Hash Generator & Checksum Calculator

Compute cryptographic hash digests and HMAC signatures directly in your browser. Generate MD5, SHA-1, SHA-256, and SHA-512 hashes for text and files with 100% client-side privacy.

Loading Hash Generator engine...

Cryptographic Digest Guide

Understanding Cryptographic Hashes & Integrity

Hash functions form the foundation of internet security, powering SSL certificates, git commit trees, software release signatures, and blockchain ledgers. Learn how digest lengths and collision resistance differ across standard algorithms.

MD5 (128-bit)

Designed by Ronald Rivest in 1991, MD5 outputs a 32-character hexadecimal digest. While computationally fast and ideal for checking downloaded file corruption, it is cryptographically broken and must never be used for security-critical authentication.

SHA-256 (256-bit)

Part of the SHA-2 family published by NIST, SHA-256 generates a 64-character hexadecimal fingerprint. It is currently the global industry standard for TLS/SSL certificates, Bitcoin proof-of-work, and API authentication signatures.

SHA-512 (512-bit)

SHA-512 computes a 128-character hexadecimal string using 64-bit word operations. On 64-bit hardware architectures, SHA-512 frequently executes faster than SHA-256 while providing maximum collision and preimage resistance.

Why Fast Hashes Must Never Be Used for Password Storage

Standard cryptographic algorithms (MD5, SHA-1, SHA-256) were intentionally engineered to be extremely fast. A modern GPU can compute billions of SHA-256 hashes per second, allowing brute-force attackers to rapidly guess passwords. Storing user passwords requires slow, memory-hard algorithms like Argon2id or bcrypt that deliberately introduce computational cost and enforce unique salts per user.

Fast Hashes (SHA-256, SHA-512)Ideal for file integrity, digital signatures, HMAC webhooks, and commit trees.

Key Derivation Functions (Argon2, bcrypt)Mandatory for password storage. Features configurable work factors and memory costs to defeat GPU cracking rigs.

Need to encode binary data or inspect JSON tokens?

Explore our complementary suite of private developer utilities.

Base64 Converter JWT Decoder

Frequently Asked Questions

A cryptographic hash function is a mathematical algorithm that transforms an arbitrary amount of data into a fixed-length string of bytes (the hash digest). It is deterministic (the same input always produces the exact same hash), fast to compute, non-reversible (one-way function), and highly sensitive to small changes (the avalanche effect, where changing a single bit changes the entire hash).