What is a Hash Function?
A cryptographic hash is a one-way function that takes any input — text, file, or password — and produces a fixed-size string of characters, called a digest or hash. The same input always produces the same output, but it's computationally infeasible to reverse the process: you can't recover the original input from the hash. Tiny changes to the input (even one character) produce completely different hashes. This makes hashes ideal for verifying data integrity, storing passwords, and creating digital fingerprints.
MD5, SHA-1, SHA-256, SHA-512
MD5 (128-bit) was designed in 1991 and is now considered cryptographically broken — collision attacks can produce two different inputs with the same hash in seconds. Still widely used for non-security checksums and legacy systems. SHA-1 (160-bit) has similar collision vulnerabilities since 2017 (Google's SHAttered attack). Avoid for new security work. SHA-256 (256-bit) is the industry standard — used in TLS, Bitcoin, code signing, and most modern security protocols. SHA-512 (512-bit) is even stronger, used in high-security applications and many password hashing schemes.
Common Use Cases
File integrity: Download a file, hash it, compare to the published hash to verify nothing was corrupted or tampered with. Password storage: Never store passwords directly — store their hashes (ideally with bcrypt/argon2). When a user logs in, hash the entered password and compare to the stored hash. Digital signatures: Hash a document, encrypt the hash with your private key — anyone can verify with your public key. Deduplication: Identify duplicate files by comparing hashes instead of full content. Blockchain: Each block contains the hash of the previous block, creating an immutable chain.
Hex vs Base64 Encoding
Hash outputs are binary data, but most contexts need text. Hex (hexadecimal) encodes each byte as two characters from 0-9 and a-f, producing a string of length 2N for an N-byte hash. SHA-256 is 32 bytes, so the hex output is always 64 characters. Base64 encodes every 3 bytes as 4 characters from a 64-character alphabet (A-Z, a-z, 0-9, +, /), producing a string of length ~4N/3. Hex is human-readable and the default for most hash displays (git commits, file checksums). Base64 is more compact and common in APIs, JWT tokens, and binary data over text protocols.
Browser-Based, Private, Fast
SHA-1, SHA-256, and SHA-512 use the browser's native Web Crypto API — the same implementation used by banks, browsers, and security software. MD5 uses the well-tested CryptoJS library (loaded once from CDN on page load). All hashing happens locally; your text never leaves the device. The hashes update instantly as you type, with no network round-trip and no server-side processing.