Hash Functions Explained: MD5, SHA-1 and SHA-256

Download pages list them, Git names every commit with one, and password databases depend on them. Hashes are everywhere in computing, yet many developers treat them as magic strings of hex. Understanding what a hash function does — and what it cannot do — helps you choose the right one, spot outdated advice and avoid storing passwords the wrong way. Here is a plain-English tour of MD5, SHA-1, SHA-256 and friends.

What a hash function does

A hash function takes input of any size — a word, a photo, a whole disk image — and returns a fixed-size output called a digest. Good cryptographic hashes share four properties:

• Deterministic — the same input always produces the same digest.
• Fast to compute in one direction.
• One-way — you cannot practically work backwards from the digest to the input.
• Avalanche effect — changing a single character changes roughly half the output bits, so similar inputs give completely different digests.

Ideally it should also be collision-resistant: finding two different inputs with the same digest should be infeasible.

Lengths at a glance

Digests are usually written in hexadecimal, where each character represents 4 bits:

• MD5 — 128 bits, 32 hex characters
• SHA-1 — 160 bits, 40 hex characters
• SHA-256 — 256 bits, 64 hex characters
• SHA-512 — 512 bits, 128 hex characters

Git commit IDs are SHA-1 digests by default, which is why they are 40 characters long; the short form you see in logs is simply the first seven or so characters.

Which hashes are still safe?

Attacks have retired some older algorithms:

• MD5 — practical collisions have been demonstrated since 2004. Fine for non-security checks such as spotting accidental corruption, but not for signatures or certificates.
• SHA-1 — a real-world collision was published in 2017. It is deprecated for security uses, and Git now offers SHA-256 repositories as an option.
• SHA-256 and SHA-512 — members of the SHA-2 family and the standard choice today for checksums, signatures and integrity checks.
• SHA-3 — a newer, differently designed standard, available when you need an alternative to SHA-2.

Passwords need a different tool

General-purpose hashes are designed to be fast, which is exactly wrong for passwords: an attacker with a leaked database can try billions of guesses per second. Password storage should use a deliberately slow, salted algorithm such as Argon2, scrypt or bcrypt. The salt — a random value stored with each hash — ensures that two users with the same password get different digests and that precomputed tables are useless.

How to get placeholder hashes with the generator

When you build a file manager, cache layer or Git dashboard, you need values that look exactly like digests. The generator above provides them:

1. Choose a Length / style: MD5-style (32), SHA-1-style (40), SHA-256-style (64), SHA-512-style (128) or a short Git hash (7).
2. Switch on Uppercase if your system displays capital hex letters; results are lowercase by default.
3. Generate up to 100 values per batch, built from secure random bytes via the Web Crypto API.
4. Paste them into fixtures, mock API responses or UI prototypes.

These strings are random, not digests of any input, so they will never match a checksum computed from a real file.

Everyday uses of hashes

Beyond security, hashes quietly power many everyday systems:

• Download verification — comparing a file’s SHA-256 with the published value.
• Version control — Git identifies every file, folder and commit by its digest, so any change produces a new ID.
• Caching — build tools put a short hash of a file’s contents in its name, so browsers fetch a new copy only when the file really changes.
• Deduplication — backup and storage systems detect identical files by comparing digests instead of full contents.
• Data structures — hash tables use fast, non-cryptographic hashes to find items quickly.

Each use needs different properties. A cache key needs speed and consistency, while a signature needs strong collision resistance, so the right algorithm depends on the job.

Pro tips

• Compare published checksums with the full digest, not just the first few characters.
• Choose SHA-256 by default for new integrity checks.
• Never store passwords with plain MD5, SHA-1 or SHA-256.
• Store digests in a consistent case so string comparisons do not fail on A versus a.
• Name the algorithm next to every stored digest, so you can upgrade to a stronger one later without guessing.

Frequently asked questions