Hash functions are one of the most fundamental building blocks in computing. They appear in password storage, file integrity verification, digital signatures, blockchain, caching, and data deduplication. Yet many developers use hash functions without fully understanding what makes one algorithm better than another, or why MD5 is deprecated for security purposes while still perfectly valid for checksums. Understanding these distinctions prevents serious mistakes and helps you choose the right tool for each job.
What a Hash Function Actually Does
A cryptographic hash function takes an input of any length and produces a fixed-length output called a digest or hash. SHA-256 always produces a 256-bit (32-byte) output regardless of whether the input is a single character or a 10 GB file. The output is typically displayed as a hexadecimal string — SHA-256 produces a 64-character hex string.
Three properties define a cryptographic hash function. First, determinism: the same input always produces the same output. Second, the avalanche effect: a single changed bit in the input produces a completely different output — there is no partial similarity between the hash of "hello" and the hash of "heLlo." Third, preimage resistance: given a hash output, it is computationally infeasible to find the original input.
Hash functions are one-way by design. You cannot reverse a hash to recover the original input — you can only verify a candidate input by hashing it and comparing. This is why hashing is used for password storage: the database stores the hash, not the password, and login verification recomputes the hash of the submitted password and compares it to the stored hash.
MD5: Fast but Cryptographically Broken
MD5 produces a 128-bit (32-character hex) digest and is extremely fast. It was designed in 1991 and was widely used for password hashing and digital signatures throughout the 1990s and 2000s. However, researchers demonstrated practical collision attacks against MD5 in 2004 — meaning two different inputs can be engineered to produce the same hash. This breaks the fundamental security property that a hash function must have.
A collision attack means an attacker can create a malicious file that has the same MD5 hash as a legitimate file, allowing them to substitute the malicious file while the hash check passes. This is why MD5 is deprecated for any security purpose: certificate signing, message authentication, or password storage.
MD5 remains appropriate for non-security uses where speed matters and collision resistance is not required: checksums for detecting accidental corruption (not deliberate tampering), cache keys, deduplication identifiers, and partitioning keys in distributed systems. The 32-character output is compact and familiar. Just never use it where a malicious actor could craft a deliberate collision.
SHA-256 and SHA-512: The Modern Standard
SHA-256 is part of the SHA-2 family, designed by the NSA and published in 2001. It produces a 256-bit (64-character hex) digest. No practical collision attacks exist against SHA-256 as of 2025. It is the current standard for digital signatures, certificate hashing, HMAC-based authentication, and blockchain proof-of-work.
SHA-512 produces a 512-bit (128-character hex) digest. It is slower than SHA-256 on 32-bit systems but faster on 64-bit systems due to internal 64-bit word operations. The larger digest provides a bigger security margin, which is relevant for long-term document archival where quantum computing advances might eventually reduce effective security. For most current applications, SHA-256 provides sufficient security.
SHA-3 (Keccak) is a third family published in 2015 as an alternative to SHA-2, not a replacement. It uses a completely different internal structure (sponge construction vs. Merkle-Damgard), providing algorithm diversity in case theoretical weaknesses in SHA-2 are ever discovered. Most applications do not need SHA-3 today, but it is available for systems requiring defense in depth.
Hash Functions vs. Password Hashing Functions
General-purpose hash functions like SHA-256 and MD5 are designed to be fast. This is exactly the wrong property for password storage. A fast hash allows an attacker who obtains your password database to test billions of candidate passwords per second. Modern GPU rigs can compute 10 billion SHA-256 hashes per second.
Password hashing functions — bcrypt, Argon2, scrypt — are intentionally slow and memory-intensive. They include a cost factor that you can tune to keep hash computation at roughly 100–300ms, making brute-force attacks millions of times slower. They also incorporate salting automatically, preventing rainbow table attacks.
The rule is absolute: never store passwords hashed with MD5, SHA-1, SHA-256, or any general-purpose hash function. Always use bcrypt, Argon2id (the recommended NIST choice), or scrypt. Using SHA-256 to hash a password is a well-intentioned mistake that leaves your users exposed in the event of a database breach.
Hash functions are not interchangeable. MD5 is appropriate for checksums and cache keys, not security. SHA-256 is the standard for digital signatures, data integrity verification, and HMAC authentication. Password storage requires a dedicated password hashing function, never a general-purpose hash. Understanding these distinctions prevents one of the most common and consequential security mistakes in web development. A hash generator is an invaluable debugging tool — it lets you verify hash outputs, test HMAC inputs, and inspect file integrity checks without writing utility scripts.