Hashing vs. Encryption: Understanding MD5, SHA-1, and SHA-256

What is a Hash?

A cryptographic hash function takes any amount of text (from a single word to an entire novel) and mathematically converts it into a fixed-length string of characters, called a hash.

Unlike encryption, hashing is a one-way street. You cannot 'decrypt' a hash back into its original text. This makes hashing perfect for storing passwords—even if a hacker steals the database, they only see the hashes, not the actual passwords.

MD5 and SHA-1: The Fallen Giants

Years ago, MD5 and SHA-1 were the standard hashing algorithms. However, as computers became faster, security researchers discovered 'collisions'—where two different files generate the exact same hash. Today, MD5 and SHA-1 are considered cryptographically broken and should only be used for basic file checksums, never for security.

The Modern Standard: SHA-256

SHA-256 (part of the SHA-2 family) is the current industry standard. It generates a 256-bit signature that is so mathematically complex that a collision is practically impossible. It is the algorithm that secures Bitcoin and most modern web certificates.

Test these algorithms yourself using our in-browser [Hash Generator](/tools/hash-generator) to see how even changing a single letter completely alters the resulting hash output.