MD5, SHA-256 and hashes explained

A hash function produces a fixed-length “fingerprint” from data of any size. The same data always gives the same result; change one character and the result changes completely.

Where hashes are used

The SHA-256 value published on a download page lets you confirm that the file you downloaded is complete and unaltered. Hashes also underpin digital signatures, Git version control and cache keys.

Why MD5 and SHA-1 are retired

For MD5 and SHA-1 it is now possible to create two different inputs with the same hash (a collision), so they must not be used where security matters. They still work for non-security tasks such as spotting accidental corruption. For security, use SHA-256 or SHA-512.

A hash is not encryption

A hash is one-way; you cannot “decrypt” the original from it. But with short or predictable data an attacker can try candidate inputs until one produces the same hash.

Plain hashes are not enough for passwords

MD5 and SHA-256 are very fast, letting attackers try billions of passwords per second. Passwords must be stored with deliberately slow, salted algorithms such as bcrypt or Argon2. In PHP, password_hash() does this for you.

The hash generator computes five algorithms in your browser and compares them with a value you provide.