Hash Functions: Which One to Use, and When
A hash function is a one-way function that turns input of any length into a fixed-length fingerprint (digest). Change a single character and the entire hash changes — which is why hashes underpin file integrity checks, duplicate detection, API signatures, and (with salts and dedicated algorithms) password storage.
This tool computes MD5 (128-bit), SHA-1 (160-bit), SHA-256, SHA-384 and SHA-512 simultaneously as you type, in a copy-ready table. The SHA family uses the browser's native Web Crypto API (crypto.subtle.digest). MD5 — which WebCrypto deliberately omits — uses a pure JavaScript implementation validated against the standard RFC 1321 test vectors. Unicode input (including CJK and emoji) is hashed correctly as UTF-8.
File mode checksums files up to 100MB. Use it to confirm a downloaded installer's SHA-256 matches the value published on the release page, or to quickly check whether two files are byte-identical. Files are read locally in your browser and never uploaded.
Choosing an algorithm: MD5 and SHA-1 have demonstrated collision attacks and are unsuitable for security — keep them for checksums and cache keys only. SHA-256 is the de facto standard for general security purposes (signatures, tokens, integrity), with SHA-384/512 when a longer digest is required. For password storage, use none of these directly — reach for bcrypt, scrypt, or Argon2 instead.