What Is a Hash Function? MD5, SHA-256 and Bcrypt Explained

A hash function turns any amount of data into a short, fixed-length fingerprint. Hash the word hello and you always get the same result. Change one letter and the fingerprint changes completely.

SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
MD5("hello")     = 5d41402abc4b2a76b9719d911017c592

Four properties that matter

• Same input, same output. That makes hashes useful for checking that a file hasn't changed.
• One way. You can't work backwards from a hash to the original data.
• Fixed size. SHA-256 always gives 256 bits (64 hex characters), whether you hash one word or a whole movie.
• Tiny changes spread. Changing one character changes the whole hash.

Which algorithms are still safe?

• MD5 and SHA-1 are broken for security use, because attackers can create two different inputs with the same hash. They are still fine for non-security jobs like spotting accidental file corruption.
• SHA-256 and SHA-512 are secure and widely used for checksums, signatures and data integrity.

Hashing isn't the same as encryption

Encryption can be reversed with a key. Hashing can't be reversed at all. That is why hashes are used to store passwords: the site can check a password without ever keeping the real one.

Why passwords need bcrypt

SHA-256 is designed to be fast, which is exactly wrong for passwords. A fast hash lets an attacker try billions of guesses per second. Password hashes such as bcrypt are deliberately slow and add a random salt, so two users with the same password get different hashes. Use the Bcrypt Generator to see how a bcrypt hash looks and to check a password against one.

Try it

Paste text or choose a file in the Hash Generator to see all the common hashes at once. And if you are creating a password, make it long and random with the Password Generator.