Hash Generator
Algorithm Selection Guide
- MD5: Collision attacks proven (2004). Use only for non-adversarial checksums where speed matters and security doesn't (deduplicating trusted backups)
- SHA-1: Practical collision attack demonstrated (Google, 2017, $110k compute). Acceptable only for Git compatibility with legacy repositories
- SHA-256: Industry standard. FIPS 140-2 approved. Required for: TLS certificates, code signing, financial transactions, regulatory compliance
- BLAKE3: 8-20x faster than SHA-256 with equivalent 128-bit collision resistance. Best for: large file checksums, content-addressed storage, high-throughput systems
- xxHash3: 50-100x faster than SHA-256 but provides zero collision resistance. Use for: in-memory hash tables, cache keys. Never for user uploads or untrusted data
- Critical: Hash functions are irreversible—attackers cannot decrypt hashes. However, weak passwords are vulnerable to rainbow table lookups (precomputed hashes of common passwords)
What is a Hash Function?
A hash function is a deterministic algorithm that maps arbitrary-length input data to a fixed-size output (hash digest). Given identical inputs, the function always produces identical outputs. For example, hashing "Hello World" with SHA-256 consistently yields: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e.
Cryptographic hash functions are irreversible one-way transformations. Modern algorithms like SHA-256 require 2256 operations to reverse through brute force—computationally impossible with current technology. This irreversibility enables secure password storage (store hashes, not plaintext), tamper-evident data integrity checks (any input change produces a completely different hash), blockchain immutability, and digital signature authentication.
Hash Algorithm Comparison: Security and Performance
MD5 (1991): 128-bit output (32 hex characters). Processes ~400 MB/s on modern CPUs. Status: Cryptographically broken since 2004—collision attacks proven practical. Use only for non-security checksums where collision resistance isn't critical (file deduplication of trusted data). Never use for passwords, digital signatures, or certificates.
SHA-1 (1995): 160-bit output (40 hex characters). Processes ~200 MB/s. Deprecated by NIST in 2011, practical attacks demonstrated in 2017. Collision attacks cost under $100,000 compute time (Google, 2017). Legacy systems (Git commits pre-2017) still use SHA-1, but migration to SHA-256 is essential for security.
SHA-256 (2001): 256-bit output (64 hex characters). Processes ~150 MB/s on single-threaded CPUs. Industry standard: FIPS 140-2 approved, NIST recommended. Used in Bitcoin mining, TLS certificates, and document signing. Collision resistance: 2128 operations (infeasible). Suitable for all security applications including financial systems and government use.
SHA-384/512 (2001): 384-bit (96 hex) and 512-bit (128 hex) outputs. Process ~200 MB/s on 64-bit systems. Required for TOP SECRET classified data (NSA Suite B). Only use when SHA-256's 128-bit collision resistance is insufficient for your threat model (quantum computing concerns) or regulatory compliance mandates 192-bit+ security.
BLAKE3 (2020): 256-bit output (64 hex characters). Processes 1-3 GB/s on modern CPUs (8-20x faster than SHA-256) via SIMD parallelization. Security equivalent to SHA-256. Ideal for high-throughput applications: content-addressed storage (IPFS alternatives), file integrity verification, checksumming large datasets. Not FIPS-approved—unsuitable for government/defense contracts requiring compliance.
xxHash3 (2019): 128-bit output (32 hex characters). Processes 10-50 GB/s—fastest general-purpose hash. Non-cryptographic: no collision resistance. Attackers can engineer collisions in milliseconds. Use cases: in-memory hash tables, Bloom filters, cache keys, integrity checks of trusted internal data. Never use for security: user-uploaded files, password hashing, digital signatures, or data from untrusted sources.
When to Use Hash Functions: 5 Production Applications
Password Storage (Use bcrypt/Argon2, not raw hashes): Application servers never store plaintext passwords. Instead: user registration → hash password with salt + KDF (10,000+ iterations) → store hash. Login verification → hash entered password → constant-time comparison. Critical: Raw SHA-256 is insufficient—attackers hash 100 billion passwords/second with GPUs. Always use purpose-built key derivation functions (PBKDF2, bcrypt, Argon2) that add computational cost.
File Integrity Verification: Linux ISOs publish SHA-256 checksums. After downloading ubuntu-24.04.iso (5 GB), run sha256sum ubuntu-24.04.iso and compare output to the official checksum. A single bit flip (corruption or tampering) produces a completely different hash, confirming file authenticity. Docker images, software updates, and npm packages use this pattern.
Digital Signatures (RSA, ECDSA): Instead of encrypting entire 50 MB contracts, sign the SHA-256 hash (32 bytes). Process: compute document hash → encrypt hash with private key → recipient decrypts signature with public key → recompute document hash → verify hashes match. Used in: SSL/TLS certificates, code signing (Windows .exe, macOS apps), PDF document signing, blockchain transactions.
Blockchain and Proof-of-Work: Bitcoin blocks store the SHA-256 hash of the previous block header, creating an immutable chain. Mining involves finding a nonce where SHA-256(SHA-256(block_header + nonce)) starts with specific zero bits (difficulty target). Altering historical transactions requires recomputing all subsequent blocks—computationally infeasible at network scale.
Content-Addressed Storage (Git, IPFS): Git commits are SHA-1 hashes of their content. Same file content produces same hash regardless of filename or location—automatic deduplication. IPFS (InterPlanetary File System) uses SHA-256 hashes as content identifiers: files referenced by hash, not location. Change one byte → entirely new hash → new version, preserving immutability.
Frequently Asked Questions
Find answers to common questions
Generate cryptographic hashes with 7 algorithms: MD5, SHA-1, SHA-256/384/512, BLAKE3 (8-20x faster than SHA-256), and xxHash3. Browser-based calculator processes data locally—no server uploads. Compare algorithm security, speed, and use cases.
