Hash Generator: MD5, SHA-256, SHA-512

What cryptographic hashes do

A hash function maps arbitrary-length input to a short, fixed-length output. Good designs are fast to compute, sensitive to tiny input changes (avalanche), and resist preimage and collision attacks in their intended threat model. MD5 outputs 128 bits; SHA-1 160 bits; SHA-256 and SHA-512 256 and 512 bits respectively. Truncated variants appear in HMAC-SHA256 truncated to 128 bits in some protocols—always follow the spec.

HMAC hashes the message with a keyed transform; knowing the digest does not let an attacker extend the message in a trustworthy way without the key (unlike naive secret + message constructions vulnerable to length-extension when mis-implemented). Plain SHA-256(message) is not an authenticity mechanism by itself—publishers often pair SHA-256 with signatures or ship digests over HTTPS so tampering in transit is detectable.

Choosing an algorithm in 2026

For new integrity or authenticity, default to SHA-256 with HMAC when a shared secret exists, or signatures (e.g., ECDSA with SHA-256) when public-key fits. SHA-512 can be faster on 64-bit CPUs for large payloads but produces longer digests. SHA-1 is deprecated for TLS and code signing in most ecosystems; you may still see it in old Git objects or legacy APIs. MD5 remains in ETags, dedup keys, and backward-compatible checksums where attackers cannot choose colliding inputs—never for security assertions.

Hashes in real workflows

Download pages publish SHA-256 checksums so you can detect corrupted or swapped files. Build pipelines hash lockfiles or bundles for reproducible artifacts. APIs use HMAC-SHA256 for request signatures. JWTs use Base64url-encoded payloads and sign with algorithms declared in the header—inspect tokens with JWT Parser, not by hashing the whole string blindly. For reversible transport encoding of the same material, Base64 Encoder is unrelated to integrity; combine layers only when your architecture requires both.

Security and operational pitfalls

Comparing a user password to SHA256(password) without salt or stretching is inadequate. Publishing a bare hash of a secret does not hide the secret if the input space is small—entropy matters. When verifying HMACs, use constant-time comparison to avoid side channels. If you need unpredictable tokens for sessions or reset links, use a CSPRNG via a Password Generator or crypto library, not a hash of the timestamp alone.

Hex casing, tools, and interoperability

Digests are often printed as lowercase hex; some ecosystems uppercase for readability. The value is the same—normalize case before string comparison. When a vendor doc shows Base64 digests instead of hex, translate with Base64 Encoder or your platform’s decoder so you are not comparing encodings of the same hash. CI jobs should pin the exact algorithm name (sha256sum vs OpenSSL output format) so copy-paste from release pages matches automated checks byte-for-byte.