Hash Generator

A hash function turns any input into a fixed-length string, and the same input always produces the same output. That is the whole contract, and it is one-way: there is no operation that recovers the original text from the hash. This makes hashing useful for verification and useless for storage you intend to read back. If you need to get the data out again, you need encryption, not hashing.

The two everyday jobs are integrity checking and comparison. Download a Linux ISO and the publisher lists a SHA-256 value; hashing your copy and matching the string proves the file arrived byte-identical and was not tampered with. Comparing two hashes is also how deduplication and change detection work, because a single flipped bit anywhere in a multi-gigabyte file produces a completely different hash.

MD5 and SHA-1 are both broken for security purposes and should never guard anything. Researchers can construct two different files with the same MD5 in seconds and the same SHA-1 in hours, which means a matching hash no longer proves two files are identical. They remain acceptable as fast non-adversarial checksums, for example detecting accidental corruption in a local cache, and nowhere else.

SHA-256 is the current default for integrity and digital signatures, with no practical attacks known. SHA-512 is not meaningfully more secure for most uses but runs faster on 64-bit hardware and produces a longer digest. Use SHA-256 unless something specifies otherwise.

None of these belong anywhere near password storage. They are designed to be fast, which is precisely the wrong property when an attacker with a stolen database is trying billions of guesses per second. Passwords need a deliberately slow, salted algorithm: bcrypt, scrypt, or Argon2.

Checksum verification only helps if the hash and the file come from different places. If both sit on the same compromised server, an attacker updates the hash alongside the file and the check passes. Take the published hash from the project's official site or its signed release notes, then hash the file you actually downloaded.

Copy the published value, generate a SHA-256 of your file, and compare. Case does not matter, since hex digests are case-insensitive, but every character does. If the values differ, the download is corrupt or has been altered; delete it rather than retrying the same mirror. A hash that matches confirms the bytes are identical to what the publisher hashed, which is a strong integrity guarantee but not a statement that the software is safe. For that you need a signature verified against a known public key.