What Is a Cryptographic Hash?
A cryptographic hash function converts any sequence of bytes into a fixed-length message digest. The same bytes and algorithm produce the same digest, while even a small input change normally produces a very different result. Hashes are useful for integrity checks, content fingerprints, cache keys, deduplication, and as building blocks inside larger cryptographic protocols.
Text entered here is converted to UTF-8 bytes before hashing. Files are hashed as their exact binary bytes, so filename changes do not affect the digest but any byte-level content change does.
Common Use Cases
📦
Download Verification
Compare SHA-256 checksums against vendor-published hashes to confirm file integrity.
🔐
Payload Fingerprints
Compare an unkeyed payload digest while debugging integrations. HMAC verification requires a secret key and is a separate operation.
🗄️
Cache Keys & ETags
Create stable fingerprints for content caching, deduplication, and CDN invalidation.
🧪
Dev & QA Workflows
Quickly hash test strings, config values, or fixtures during local development.
Which Hash Algorithm Should You Use?
| Algorithm | Output | Best For |
|---|---|---|
| MD5 | 128 bits / 32 hex | Legacy compatibility, cache keys, non-adversarial checks only |
| SHA-1 | 160 bits / 40 hex | Git and legacy compatibility; avoid for security decisions |
| SHA-256 | 256 bits / 64 hex | General file integrity and modern interoperability |
| SHA-384 | 384 bits / 96 hex | SHA-2 protocols or policies that specifically require it |
| SHA-512 | 512 bits / 128 hex | SHA-2 protocols requiring a 512-bit digest |
Best Practices
- Use SHA-256 as a broadly interoperable default for file integrity; follow the target protocol when it requires SHA-384 or SHA-512.
- Never use MD5 or SHA-1 for password storage or digital signatures.
- Compare checksums case-insensitively — hex casing does not change the digest.
- Obtain the expected checksum from a trusted HTTPS page or independently authenticated source.
- A matching checksum confirms identical bytes to that digest; it does not establish who published the file.
Hashes, HMACs, and Password Storage Are Different
Plain hash
An unkeyed digest such as SHA-256. Useful for detecting byte changes when the expected digest comes from a trusted source.
HMAC
A keyed message authentication code. It requires a secret key and authenticates data between parties that share that key; this tool does not generate HMACs.
Password hash
A salted, deliberately expensive password-hashing function such as Argon2id, scrypt, bcrypt, or PBKDF2. Fast MD5 and SHA digests alone are unsuitable.
Continue Your Developer Workflow
Convert hexadecimal digests into binary, decimal, or another numeric base with the Number Base Converter, convert binary data to a transport-friendly representation with the Base64 Encoder & Decoder, inspect signed token claims with the JWT Decoder & Debugger, encode a digest for a URL component using the URL Encoder & Decoder, or generate identifiers that are independent of content with the UUID v4 / GUID Generator.
Hash Standards and Security References
SHA-1 and the SHA-2 family are specified by NIST FIPS 180-4. Browser digest behavior and supported SHA algorithms are documented by MDN's SubtleCrypto.digest reference. For authentication systems, review the OWASP Password Storage guidance. External references open in a new tab.