Last updated 23 August 2026
What a hash is for
A hash turns any input into a fixed-length string that changes completely if even one character of the input changes. It's one-directional — there's no way to run it backwards — which is what makes it useful for checking that a file wasn't altered, verifying a download matches what the publisher intended, or confirming two pieces of text are identical without comparing them directly.
Choosing an algorithm
SHA-256 is the sensible default for almost everything — it's what Git commit hashes and most modern checksums use. SHA-1 is older and weaker, kept mainly for compatibility with systems that still expect it. SHA-384 and SHA-512 produce longer hashes for cases that specifically call for it. MD5 isn't offered at all — it's not part of the browser's built-in crypto API, and it's been considered broken for security use for years.
Common questions
Why isn't MD5 an option?
Browsers don't include MD5 in their built-in cryptographic API — only the SHA family. MD5 is also considered broken for security purposes, since collisions can be deliberately constructed, so SHA-256 or better is the modern default anyway.
Which algorithm should I use?
SHA-256 is the standard general-purpose choice — it's what Git, TLS certificates and most modern checksums use. SHA-1 is weaker and mainly relevant for compatibility with older systems; SHA-384 and SHA-512 are used where a longer hash is specifically required.
Can a hash be reversed back to the original text?
No, not by design. A hash function only goes one way. The only way to "find" matching input is to guess many inputs and hash each one, which is why hashing weak, predictable text like common passwords is not actually secure.