When you create a password on a website, a responsible service never stores the password itself — it stores a hash of your password. Understanding what that means, and why it matters, is fundamental to understanding password security.
What is a hash function?
A hash function is a mathematical algorithm that takes any input (a word, a file, a sentence) and produces a fixed-length string of characters called a hash or digest. It has three essential properties:
- Deterministic — the same input always produces the same output.
- One-way — you can compute the hash from the input, but you cannot compute the input from the hash.
- Avalanche effect — changing one character in the input produces a completely different output.
SHA-256 of "password":
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
SHA-256 of "password1" (one character added):
0b14d501a594442a01c6859541bcb3428d9596cfd3c8b0a5b39e82d4953a1a2b
Completely different output — that's the avalanche effect.
Why websites hash passwords
When you log in, the site hashes your submitted password and compares it to the stored hash. If they match, you're authenticated — without the site ever storing or knowing your actual password.
This means that even if a site's database is stolen, attackers only get hashes — not passwords. In theory. In practice, weak passwords and weak hashing algorithms can still be reversed.
The major hashing algorithms
MD5 (1992)
MD5 produces a 128-bit (32 hex character) hash. It was the dominant standard for years but is now completely broken for cryptographic purposes. In 2004, researchers demonstrated MD5 "collisions" — two different inputs that produce the same hash. MD5 hashes can be cracked in seconds using modern hardware and rainbow tables.
Use case today: Non-security checksums only. Never for password storage or digital signatures.
SHA-1 (1995)
SHA-1 produces a 160-bit (40 hex character) hash. The first practical collision was demonstrated in 2017 by Google's SHAttered project. SHA-1 was formally deprecated by NIST in 2011 and phased out of TLS/SSL in 2017.
Use case today: Legacy systems only. Avoid for any new application.
SHA-256 (2001)
Part of the SHA-2 family, SHA-256 produces a 256-bit (64 hex character) hash. No collisions have ever been found. It is the current industry standard used in TLS certificates, code signing, Bitcoin, and the vast majority of modern security applications.
Use case today: File integrity verification, digital signatures, HMAC tokens, certificate fingerprints. Widely recommended.
SHA-512 (2001)
Also part of SHA-2, SHA-512 produces a 512-bit (128 hex character) hash. More computation-intensive than SHA-256 but faster on 64-bit systems due to its 64-bit word operations. Provides a higher security margin for extremely sensitive applications.
Use case today: High-security environments, key derivation, applications that need maximum collision resistance.
Hashing vs. encryption — a common confusion
Hashing
- • One-way only
- • Cannot be reversed
- • Fixed output length
- • Used for verification
- • Same key not needed
Encryption
- • Two-way (reversible)
- • Can be decrypted with key
- • Variable output length
- • Used for confidentiality
- • Requires a secret key
Why you shouldn't use SHA-256 directly for passwords
SHA-256 is extremely fast — which is a problem for password storage. An attacker with a GPU can compute billions of SHA-256 hashes per second, making brute-force attacks trivial against common passwords.
For password storage specifically, you should use purpose-built password hashing functions that are deliberately slow:
- bcrypt — adjustable work factor, still widely used
- Argon2 — winner of the Password Hashing Competition (2015), memory-hard
- scrypt — memory-hard, used in many cryptocurrency systems
SHA-256 and SHA-512 are for verifying file integrity and data authenticity — not for storing passwords directly.
Salting: making hashing stronger
Even bcrypt can be defeated if an attacker precomputes hashes for millions of common passwords (a "rainbow table"). The defense is salting — appending a unique random string to each password before hashing. This makes rainbow tables useless because every salt produces a unique hash, even for identical passwords.
Modern password hashing libraries handle salting automatically. This is another reason to use bcrypt/Argon2 rather than raw SHA-256 for password storage.
Try it yourself
Our Hash Generator lets you compute MD5, SHA-1, SHA-256, and SHA-512 hashes directly in your browser. Your input never leaves your device — it's processed entirely with the Web Crypto API.
Frequently asked questions
Can a hash be reversed to get the original password?
No — not mathematically. But attackers can try billions of guesses, hashing each one and comparing to the target. This is why strong, unique passwords matter even when a site uses SHA-256.
Why is MD5 still used if it's broken?
Because collision resistance is only needed for some use cases. MD5 is still perfectly fine for non-security checksums like verifying that a downloaded file wasn't corrupted in transit.
What is a hash collision?
A collision is when two different inputs produce the same hash. For security applications, this is catastrophic — it means an attacker could substitute a different file or input that passes verification. SHA-256 has no known collisions.
What does SHA stand for?
Secure Hash Algorithm. SHA-1 and SHA-2 were developed by the NSA and published as NIST standards. SHA-3 (Keccak) was developed through an open competition and standardized in 2015 as an alternative construction.