How to Generate MD5, SHA-256 and SHA-512 Hashes
Quick summary
Learn what a hash is, how MD5, SHA-1, SHA-256 and SHA-512 differ, when to use each algorithm, and why MD5 is broken for any security use.
A hash is a fixed-length fingerprint produced by a one-way mathematical function: the same input always yields the same output, but the output cannot be reversed back to the input. SHA-256 and SHA-512 are the recommended algorithms for any security-related use, while MD5 and SHA-1 are broken and kept only for legacy checksums. The NeatForge Hash Generator computes all five at once in your browser.
What Is a Hash?
A cryptographic hash function takes arbitrary input (text, a file, a message) and returns a fixed-size string of hex characters. A good hash has three properties:
- Deterministic — the same input always produces the same hash.
- One-way — you cannot recover the input from the hash.
- Avalanche — changing one bit of input completely changes the output.
Hashing is different from encryption: encryption is two-way and reversible with a key, while hashing is one-way. Use hashing for integrity checks and password storage; use encryption for confidentiality.
MD5 vs SHA-1 vs SHA-256 vs SHA-512
| Algorithm | Output length | Security status | Typical use |
|---|---|---|---|
| MD5 | 128 bits | Broken | Legacy checksums only |
| SHA-1 | 160 bits | Broken | Legacy systems, old Git |
| SHA-256 | 256 bits | Secure | Modern checksums, TLS, Git |
| SHA-512 | 512 bits | Secure | High-security applications |
SHA-256 and SHA-512 belong to the SHA-2 family and are recommended for any new system.
When to Use Each Algorithm
- Checksums and file integrity — SHA-256 is the modern default. Compare a downloaded file’s hash against the publisher’s value to confirm it was not altered.
- Git and content addressing — Git historically uses SHA-1, and newer versions support SHA-256 for stronger integrity.
- Password storage — never use plain MD5 or SHA-1. Use a slow, salted algorithm such as bcrypt, scrypt or Argon2 instead.
- Legacy system integration — some older APIs still require MD5 or SHA-1; this tool provides them without installing extra software.
Why MD5 Is Broken
MD5 is cryptographically broken: researchers can produce two different inputs with the same MD5 hash (a collision) in seconds on ordinary hardware. For this reason MD5 must never be used for digital signatures, certificate authorities, or password storage. It remains useful only as a quick non-security checksum for legacy systems where collisions are not a threat.
How to Generate a Hash
- Open the Hash Generator.
- Type or paste the text you want to hash.
- Click Compute Hashes to generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once.
- Use the Copy button next to any hash, and toggle uppercase output if your toolchain expects it.
SHA hashes are computed with the browser’s native Web Crypto API (crypto.subtle.digest), which is hardware-accelerated and audited. Your input is never uploaded.
FAQ
Is MD5 still safe to use? No. MD5 is broken and should never be used for password storage, signatures or any security-sensitive purpose. Use it only for legacy checksum verification.
Which hash should I use? SHA-256 for general use, SHA-512 for high-security applications. Both are part of the SHA-2 family and considered secure.
What is the difference between hashing and encryption? Hashing is one-way and cannot be reversed. Encryption is two-way and can be decrypted with a key. Use hashing for integrity, encryption for confidentiality.
→ Open the free Hash Generator