Hash Generator Online

What Is a Cryptographic Hash?

A hash function takes an input of any size and produces a fixed-length output (the digest) that looks like random bytes. The same input always produces the same hash. Change even one character and the output is completely different — this property is called the avalanche effect.

Hash functions are one-way: given a digest, there's no feasible way to recover the original input. This makes them a fundamental building block in cryptography, security, and software engineering.

🔑 Core Properties

• Deterministic: same input → same hash, always.
• Pre-image resistant: can't reverse a hash back to the input.
• Collision resistant: practically impossible to find two inputs with the same hash.
• Avalanche effect: a single bit change in the input flips ~50% of the output bits.

📦 Real-World Use Cases

• File integrity: software downloads ship a SHA-256 checksum so you can verify the file wasn't corrupted or tampered with in transit.
• Password storage: databases store the hash of your password, not the plaintext. At login, the server hashes what you type and compares — it never needs to know the real password.
• Digital signatures: signing a document means signing its hash (much smaller), then encrypting that hash with a private key.
• Git commits: every Git commit is identified by a SHA-1 (now moving to SHA-256) hash of its content and metadata.
• Blockchain: each block contains the hash of the previous block, making the chain tamper-evident.
• Deduplication: content-addressable storage (like Docker layers) identifies content by its hash — if two files hash the same, they're stored once.

⚠️ SHA-1 and MD5 Are Broken

MD5 and SHA-1 are cryptographically broken — researchers have demonstrated real collision attacks. SHA-1 was officially deprecated by NIST in 2011. Don't use either for security purposes (certificates, signatures, password hashing). For integrity and signatures, use SHA-256 or SHA-512. For passwords, use a dedicated KDF like bcrypt, Argon2, or scrypt — plain SHA is too fast and vulnerable to GPU-based attacks.

🛠️ Choosing the Right Algorithm

All hashing runs in your browser via the Web Crypto API — your input is never sent anywhere.