Hash Functions Explained — MD5, SHA-1, SHA-256: What's the Difference?
A hash function turns any input into a fixed-length fingerprint. It is one-way, not encryption. MD5 and SHA-1 are broken for security because collisions can be faked. Use SHA-256 or SHA-512 for checksums and signatures. A hash generator online is fine for checksums — do not store passwords as raw MD5.
MD5 looks like a password. It is 32 hex characters, it changes if you sneeze on the file, and tutorials still say "hash the password with MD5." That last sentence is how leaks happen.
This is the difference between MD5, SHA-1, SHA-256, and SHA-512: what a hash actually is, why two of those names are retired for security, and when a hash generator online is the right tab versus a password manager.
If you already know hashes are one-way and you only needed encoding, that is Base64. If you need to hide a message, that is password-based encryption. This post is fingerprints, not locks.
What a hash function is (and is not)
A hash maps any input — a password, a PDF, a whole disk image — to a fixed-length digest. SHA-256 always gives you 256 bits (64 hex characters). MD5 always gives 128 bits. Same input, same output, forever. Change one comma, and the digest looks unrelated. That avalanche is the feature.
It is one-way. There is no SHA-256 "decode." You can only hash again and compare. That is why checksums work: the website publishes SHA256 (file.zip) = abc… and you hash your download. Match means integrity; mismatch means corruption or tampering.
It is not encryption. Encryption needs a key and a reverse step. A hash has neither. Storing md5(password) in a database is not "encrypted passwords." It is a fingerprint attackers can rainbow-table.
It is not encoding. Base64 round-trips. Hashes do not.
Properties you want from a cryptographic hash: preimage resistance (hard to find an input for a given digest), second-preimage resistance (hard to find a different input with the same digest), and collision resistance (hard to find any two inputs that collide). MD5 and SHA-1 failed the last one in public.
MD5 vs SHA-1 vs SHA-256 vs SHA-512
| Algorithm | Digest | Security status |
|---|---|---|
| MD5 | 128-bit (32 hex) | Broken for collisions — do not use for security |
| SHA-1 | 160-bit (40 hex) | Broken — NIST retired it; browsers rejected SHA-1 certs years ago |
| SHA-256 | 256-bit (64 hex) | Current default for checksums and signatures |
| SHA-512 | 512-bit (128 hex) | Same SHA-2 family, longer digest; use when a spec asks for it |
What is SHA-256? The SHA-2 workhorse. Git, TLS, Linux ISO checksums, and most "verify this download" pages mean this unless they say otherwise. NIST retired SHA-1 for new federal use — treat SHA-1 like MD5 for anything you start today.
Difference between MD5 and SHA-256: length, and whether an attacker can mint a second file with the same hash. For MD5, yes — cheaply, with published collision attacks. For SHA-256, not with anything public and practical. SHA-1 sits in the middle historically and is now in the same "do not use" bucket as MD5 for new security work (the SHAttered PDF collision made that visceral).
When we built the Hash Generator, the browser's Web Crypto API offered SHA-1, SHA-256, and SHA-512 — and not MD5. We had to bundle MD5 ourselves. That is the ecosystem voting with its feet: MD5 is there so you can match a legacy checksum, not so you can design a login.
Indian bank PDFs, older GST return tools, and internal "file received" emails still print MD5. Match what they published. Do not copy that choice into a new API.
File integrity, passwords, and signatures
File integrity. Download an Ubuntu ISO or a vendor ZIP, hash it with SHA-256, compare to the published digest. That is the honest everyday use of a hash generator. MD5 on a download page is a smell; SHA-256 is the expected line.
Digital signatures. Signing hashes a document first, then encrypts (or rather, applies the signature algorithm to) that digest. You sign the fingerprint, not the 200-page PDF. SHA-256 is the usual hash inside those schemes. SHA-1 certificates were a browser-blocking event, not a trivia item.
Password storage. This is where tutorials lie. Hashing a password with MD5 or even raw SHA-256 is not how you store passwords. You need a slow, salted password hash: Argon2, bcrypt, scrypt, or PBKDF2 with a high iteration count — the same family as in our encryption explainer. Fast hashes exist so checksums are cheap; attackers love cheap. Generate a strong unique password with the Password Generator and put it in a manager. Do not "MD5 it yourself" and call it security.
Git and content addressing. SHA-1 still appears in older Git; Git moved toward SHA-256. Seeing SHA-1 in a repo is history, not a recommendation for your next checksum.
My rule: SHA-256 to verify a file. Slow salted hash to store a password. Encryption to hide a message. Mixing those three is how MD5-vs-SHA-256 articles accidentally teach people to hash logins with SHA-256 and feel modern.
Using a hash generator without making it worse
Paste the file's published checksum or a non-secret string. If the string is a production token, run the hash on your machine — our tool never uploads — or use sha256sum locally. Random websites that POST your input to a server to "generate MD5" are a supply-chain joke.
Watch the avalanche: type hello then Hello. All four digests should jump. That demo is why people bookmark a hash generator online. Then look at MD5 versus SHA-256 of the same text and remember the short one is the legacy name.
You can compare MD5, SHA-1, SHA-256, and SHA-512 instantly using the Hash Generator at TinyToolStudio — free, no signup, all four at once in the browser. For accounts, skip hashing theater and use the Password Generator plus a manager instead.
Try it free → www.tinytoolstudio.com/tools/hash-generator
Frequently Asked Questions
- What is the difference between MD5 and SHA-256?
- Both output a hex fingerprint of your data. MD5 is 128 bits and collision-resistant no longer — two different files can share an MD5. SHA-256 is 256 bits, still the default for checksums, Git, TLS certificates, and Bitcoin-style commitments. For anything security-sensitive, pick SHA-256 (or SHA-512). Keep MD5 for legacy checksums you already have to match.
- What is SHA-256?
- SHA-256 is a member of the SHA-2 family: a one-way hash that produces a 64-character hex string (256 bits). Same input always gives the same digest; a one-character change scrambles the whole output. It is the workhorse for file integrity, digital signatures, and blockchain, not for hiding secrets by itself.
- Is MD5 still secure?
- Not for security. Practical collisions have existed for years, so MD5 must not be used for certificates, password storage, or anything where an attacker benefits from a fake match. It is still used as a fast non-cryptographic checksum in some old tools. Prefer SHA-256 when you have a choice.
- Is hashing the same as encryption?
- No. Encryption is reversible with a key. A hash is a one-way fingerprint with no key and no 'decode.' If you can turn the output back into the message, you used encoding (like Base64) or encryption — not a hash.
- Where can I find a hash generator online?
- Use a browser tool that computes MD5, SHA-1, SHA-256, and SHA-512 on your device and does not upload the text. TinyToolStudio's Hash Generator runs locally — useful for comparing a published checksum, not for dumping production passwords into a random website.