Crypto Hash Generator — SHA-256, MD5, SHA-1, SHA-512, Keccak-256

How Crypto Hash Works

Hash = H(message) | H is a one-way cryptographic function with fixed output size

A cryptographic hash function maps input data of arbitrary size to a fixed-size output (the hash/digest). Hashing is a one-way operation: you cannot reverse a hash to recover the original input. Small changes in input produce dramatically different hashes (avalanche effect).

SHA-256

Secure Hash Algorithm 256-bit — NIST-standard 256-bit hash. Used in Bitcoin, TLS, and file integrity verification. Outputs 32 bytes (64 hex chars).

MD5

Message Digest 5 — 128-bit hash. Fast but cryptographically broken — vulnerable to collision attacks. Do not use for security. Still used for checksums.

SHA-1

Secure Hash Algorithm 1 — 160-bit hash. Deprecated after SHAttered collision attack in 2017. Being phased out of TLS certificates.

SHA-512

Secure Hash Algorithm 512-bit — 256-bit security level. Outputs 64 bytes (128 hex chars). Used in high-security applications.

Keccak-256

Keccak (SHA-3) 256-bit — SHA-3 winner. Uses sponge construction instead of Merkle-Damgard. Different internals than SHA-2.

How to Use

1. Type or paste text into the input field.
2. Select a hash algorithm from the dropdown.
3. The hash is computed instantly in your browser — no data is sent to any server.
4. Compare hashes across algorithms to see different output sizes.
5. Try changing one character in the input to see the avalanche effect.

Quick Reference

Common Uses

• •Verifying file integrity by computing and comparing SHA-256 checksums after downloading software, firmware, or data archives
• •Understanding how cryptographic hashing works for password storage, digital signatures, and blockchain applications
• •Comparing hash algorithms such as SHA-256, MD5, and SHA-512 to understand output sizes and security properties for different use cases
• •Demonstrating the avalanche effect by observing how small input changes produce completely different hash outputs

Understanding the Result

Cryptographic hashing is a fundamental building block of modern security. Unlike encryption, hashing is one-way: you cannot "decrypt" a hash. This makes hashes ideal for password storage (systems store hashes, not passwords), file integrity verification (compare checksums), digital signatures, and blockchain technology. The avalanche effect means changing even one bit of input flips approximately 50% of output bits. SHA-256 is currently the most widely deployed secure hash; MD5 and SHA-1 should not be used for security purposes as they are vulnerable to collision attacks where two different inputs produce the same hash.

Worked Examples

Frequently Asked Questions

What is the difference between hashing and encryption?

Hashing is one-way: you cannot reverse a hash to get the original input. Encryption is two-way: encrypted data can be decrypted with the correct key. Hashing produces a fixed-size output regardless of input size; encryption output size varies with input size. Hashes are deterministic (same input always produces same hash).

Why is MD5 considered broken?

MD5 is vulnerable to collision attacks — it is computationally feasible to find two different inputs that produce the same MD5 hash (first demonstrated in 2004). This breaks the collision resistance property. MD5 should not be used for security-sensitive applications, though it remains acceptable for non-security checksums.

What is the avalanche effect?

A desirable property of cryptographic hash functions where a small change in input (e.g., changing one bit) causes approximately half the output bits to change. This makes it impossible to predict how changing the input will affect the output, which is crucial for security. Try it here: hash "hello" and "Hello" and see how completely different the outputs are.

Can I reverse a hash to get the original input?

No, that is mathematically impossible by design. Hash functions are one-way operations — they are deliberately constructed to lose information. Given a SHA-256 hash like e3b0c44..., there is no algorithm to compute what input produced it. The only attack is brute-force: trying every possible input until one matches. For a strong hash with a long random input, this is computationally infeasible.

What is the difference between SHA-256 and SHA3-256?

Despite the similar naming, they are completely different hash functions with different internal designs. SHA-256 uses the Merkle-Damgard construction with the Davies-Meyer compression function. SHA3-256 (Keccak) uses a sponge construction. SHA-3 was selected through an open NIST competition after concerns about SHA-2 emerged. Both are considered secure as of 2026, but SHA-3 offers a structurally different backup in case weaknesses are ever found in the SHA-2 family.

Why does SHA-512 produce 128 hex characters when it says 512 bits?

Each byte (8 bits) is represented by 2 hex characters. SHA-512 produces 512 bits (64 bytes), so the hex representation is 64 x 2 = 128 characters. Similarly, SHA-256 produces 256 bits (32 bytes), which is 64 hex characters. The hex output is always exactly twice the byte length.

What is a collision attack and why is it dangerous?

A collision attack occurs when an attacker can find two different inputs that produce the same hash output. This is dangerous because it means a malicious file could have the same hash as a legitimate one. Digital signatures and certificates rely on collision resistance — if an attacker can create a fake certificate that hashes the same as a real one, they can impersonate any website. MD5 collisions can be computed in seconds on a laptop; SHA-1 collisions were demonstrated in 2017 using Google's computing power. No practical collision attack is known against SHA-256 or SHA-3 as of 2026.

Pro Tips

• →Use SHA-256 for all new projects. It has no known practical vulnerabilities and is the most widely supported secure hash algorithm across platforms and languages.
• →For password storage, never hash alone — use a key-derivation function like bcrypt, Argon2, or PBKDF2 with a random salt. Hashing alone is vulnerable to rainbow table attacks.
• →When verifying file downloads, always check the hash from the official website (not from a forum post). Attackers have been known to replace both the file and the posted hash on compromised sites.
• →The Web Crypto API used by this calculator runs entirely in your browser. No data is sent to any server — you can verify this by disconnecting from the internet and still generating hashes.
• →For blockchain and Merkle tree applications, double-SHA-256 (SHA-256 of SHA-256) is standard. Bitcoin uses this two-round approach to protect against length-extension attacks.

Limitations to Know

• •This calculator performs hashing entirely in the browser using the Web Crypto API (SubtleCrypto). It does NOT perform keyed hashing (HMAC) or password-based key derivation (PBKDF2/bcrypt/Argon2).
• •MD5 and SHA-1 are included for educational and compatibility purposes only — both are cryptographically broken and should never be used for security-sensitive applications.
• •The calculator does not detect hash type (you cannot paste a hash to identify the algorithm). For production password storage, use a proper key-derivation function with a random salt, not plain hashing.

Sources

• Cryptographic Hash Function
• Hash Function
• Secure Hash Standard (SHS)