Hash Functions Made Simple: MD5 vs SHA-1 vs SHA-256 and How to Use Them
Download checksums, Git commit IDs and blockchain addresses are all hash values. This guide explains how hashing differs from encryption and which algorithm to choose for each job.
What a hash function is
A hash function takes input of any length and produces a short value of fixed length, called a hash or digest. Whether you hash one word or a multi-gigabyte video, SHA-256 always outputs 256 bits, or 64 hexadecimal characters.
Crucially, hashing is one-way. There is no way to compute the original input from the hash. That is the key difference from encryption, which can be reversed with a key, and from Base64, which anyone can reverse.
Three properties of a good hash
A cryptographic hash function used for security must satisfy the following.
- Deterministic: the same input always produces the same hash.
- Avalanche effect: changing a single character changes the output completely, as the example below shows for hello and hello!.
- Collision resistance: it must be practically impossible to find two different inputs with the same hash.
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hello!") = ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b
MD5("hello") = 5d41402abc4b2a76b9719d911017c592Case matters too: Hello and hello produce unrelated hashes. When comparing hashes, first make sure the inputs match exactly, including spaces, line breaks and capitalisation.
MD5, SHA-1 and SHA-256 compared
MD5 produces a 128-bit (32 hex character) digest. It is fast, but practical collision attacks have been known since 2004, so it must not be used for security. It is still acceptable as a simple checksum against accidental corruption.
SHA-1 produces 160 bits. In 2017 researchers from Google and CWI published two different PDF files with the same SHA-1 hash (SHAttered), ending its use for security. Browsers and certificate authorities no longer trust SHA-1 certificates.
SHA-256 belongs to the SHA-2 family and produces 256 bits. It is the de facto standard for software checksums, TLS certificates and blockchains. For new systems, SHA-256 or stronger is the default choice.
Verifying files with checksums
Download pages often list a SHA-256 value next to the file. Compute the hash of the file you downloaded and compare: if a single bit changed in transit or was tampered with, the hash will be completely different.
If the checksum is hosted on the same server as the file, an attacker could replace both. Important software therefore signs the checksum file with GPG or publishes it through a separate HTTPS channel.
Why plain SHA-256 is wrong for passwords
If hashes are one-way, storing passwords as SHA-256 sounds safe, but it is not. SHA-256 is designed to be fast, and a single GPU can compute billions of hashes per second. An attacker who steals a list of hashes can test common passwords at enormous speed.
Use purpose-built, deliberately slow functions such as bcrypt, scrypt or Argon2. They mix a unique random salt into each password so that identical passwords produce different stored values, which also defeats precomputed rainbow tables.
Hash, HMAC or encryption?
Use the AIBIZAP hash generator to run the same sentence through several algorithms and see how much the result changes when you alter a single character. If you need to hide data and recover it later, try the AES encryption tester.
- Check that data has not changed: a SHA-256 hash.
- Check that a message came from someone holding a shared secret: HMAC-SHA256 (webhook and API request signatures).
- Store passwords: bcrypt, scrypt or Argon2.
- Hide data and read it back later: encryption such as AES-GCM.