Hash
SHA-1, SHA-256 and SHA-512 digests
A cryptographic hash reduces any input to a fixed-length digest — 160 bits for SHA-1, 256 or 512 for the SHA-2 family — in a way that is cheap to compute forwards and infeasible to reverse. Change a single bit of the input and roughly half the output bits flip, which is what makes a digest a usable fingerprint for a file, a message or a build artefact.
The everyday uses are verification and comparison: confirming a download matches what the publisher shipped, checking whether two files differ without reading both, deriving a cache key from content. What a bare hash is not suitable for is storing passwords — SHA-256 is designed to be fast, and fast is precisely the wrong property when someone is guessing billions of candidates a second.
How to use it
- Paste the text to hashInput is encoded as UTF-8 before hashing, which is what almost every other tool and language does by default, so digests match what you would get from a shell or a standard library.
- Read the digestsSHA-1, SHA-256 and SHA-512 are computed together so you can compare against whichever one a checksum file happens to publish.
- Compare, do not eyeballCopy the digest and paste it next to the expected value rather than reading hex by eye. Attacks that matter change the middle of a string, not the ends people actually check.
Frequently asked questions
Can a hash be reversed back to the original text?
Not by inverting it — the function destroys information, and many inputs map to any given digest. What is possible is guessing: hashing candidate inputs until one matches. For a short or common input that is trivial, which is why unsalted hashes of passwords, email addresses or phone numbers offer almost no protection.
Should I use SHA-256 to store passwords?
No. SHA-256 is built to be fast, and a modern GPU computes billions of them per second. Password storage needs a deliberately slow, memory-hard function with a per-user salt: Argon2id, scrypt or bcrypt. Use SHA-2 for integrity and fingerprinting, never as a password hash on its own.
Is SHA-1 broken?
For security purposes, yes. A practical collision was demonstrated in 2017, meaning two different inputs producing the same digest can be constructed, so SHA-1 must not be used for signatures or certificates. It survives in places where collision resistance is not the property being relied on, such as Git object naming, but nothing new should adopt it.
What is the difference between SHA-256 and SHA-512?
Both are SHA-2, differing in internal word size and output length. SHA-512 uses 64-bit operations and is often faster on 64-bit hardware despite producing a longer digest. Either is a sound choice today; SHA-256 is more widely expected by tooling, which is usually the deciding factor.
Why does my digest not match the one on the download page?
Almost always a difference in what was hashed rather than in how. A trailing newline, a byte-order mark, or CRLF line endings all change the input. Publishers hash the exact file bytes, so hashing text you pasted from a viewer will not reproduce a file checksum.