What Is a Hash? MD5, SHA-256 and How Hashing Works

A hash is a fixed-length fingerprint of data, produced by running that data through a hash function. Feed in a word, a file or a whole book, and out comes a short string of characters that is effectively unique to that input, change a single character and the hash changes completely. The Hash Generator produces hashes like MD5 and SHA-256 in your browser, and this article explains what hashing is, why it is one-way, and what it is genuinely used for.

Hashing is one of the most useful and most misunderstood ideas in computing. It is not encryption, it is not compression, and it is not reversible. Understanding what it actually is clears up a surprising amount of confusion about passwords, downloads and data integrity.

What a hash function does

A hash function takes any input, of any size, and always produces an output of the same fixed length. SHA-256, for example, always produces a 256-bit result written as 64 hexadecimal characters, whether you hash the letter 'a' or an entire film. Two properties make this useful. First, it is deterministic: the same input always produces the same hash. Second, it is extremely sensitive: changing the input even slightly, one letter, one bit, produces a completely different, unpredictable hash. Together these mean a hash acts as a compact, reliable fingerprint of its input.

Why hashing is one-way

The defining feature of a cryptographic hash is that it cannot be reversed. Given the input you can easily compute the hash, but given only the hash there is no practical way to work backwards to the input. This is by design, a good hash function scrambles its input so thoroughly that the output reveals nothing about what produced it. This one-way nature is exactly what makes hashing different from encryption: encryption is meant to be reversed with a key, while hashing is meant to be a dead end. You hash something not to get it back, but to verify or fingerprint it.

MD5 versus SHA-256

Not all hash functions are equal, and the difference matters for security. MD5 is old and fast, and still fine for non-security uses like a quick checksum to detect accidental corruption. But MD5 is cryptographically broken: attackers can deliberately create two different inputs with the same MD5 hash (a 'collision'), so it must not be used where security depends on the hash being unique. SHA-256, part of the SHA-2 family, is the modern standard, it has no known practical collisions and is trusted for security-critical work. The rule of thumb: MD5 for a casual integrity check, SHA-256 (or stronger) whenever security matters.

What hashing is actually for

Hashing quietly underpins a lot of computing:

• Verifying downloads: comparing a file's hash to a published one confirms it arrived intact and unaltered.
• Storing passwords: sites store the hash of your password, not the password itself, so a database breach does not directly reveal it.
• Detecting changes: a changed hash means the data changed, which is how version control and backup tools spot modifications.
• Digital signatures and blockchains: both rely on hashing to fingerprint data compactly and tamper-evidently.

In each case the value is the same: a hash is a small, reliable stand-in for a larger piece of data that changes whenever the data does.

Hashing and passwords

Password storage deserves a special mention because it is where hashing's one-way nature shines. When you create a password, a well-built site stores only its hash. When you log in, it hashes what you typed and compares the two hashes, if they match, you are in, and the site never needed to keep your actual password. Because hashing is one-way, even someone who steals the hash database cannot simply read the passwords. (Real systems add 'salt' and use deliberately slow password-specific hash functions to resist guessing, but the one-way hash is the foundation.) This is why the strength of your password still matters, which a password strength checker helps you gauge.

Generating and comparing hashes

The two everyday jobs are generating a hash and comparing two hashes. You generate a hash to fingerprint something, a file, a message, a value. You compare hashes to verify a match, which is what confirms a download is intact or that two files are identical; a dedicated hash comparison tool makes that check foolproof, since eyeballing two 64-character strings is error-prone. And where you need to actually protect and later recover data rather than fingerprint it, an encryption tool is the right choice instead.

Collisions and why they matter

The security of a hash function rests on one hard problem: it should be practically impossible to find two different inputs that produce the same hash. Such a pair is called a collision, and while collisions must exist in theory, there are infinitely many possible inputs but only a finite number of fixed-length outputs, a strong hash function makes finding one computationally infeasible. This is precisely where MD5 fell: researchers found ways to generate MD5 collisions deliberately and quickly, which means MD5 can no longer guarantee that a matching hash implies identical data.

Why does this matter in practice? Consider verifying a download. If an attacker can craft a malicious file with the same MD5 hash as a legitimate one, then a matching MD5 no longer proves the file is genuine, the attacker could substitute their version and the check would still pass. With SHA-256, no such collision is practically achievable, so a matching SHA-256 hash remains strong evidence that the data is exactly what it should be. This is the concrete reason the industry moved from MD5 and the older SHA-1 to SHA-256 and beyond for anything security-sensitive. For a casual check that a file was not accidentally corrupted in transit, where there is no attacker deliberately engineering collisions, MD5 is still perfectly serviceable and fast. But the moment security depends on the guarantee, only a collision-resistant function like SHA-256 will do. Understanding collisions is what turns 'use SHA-256 for security' from a rule you follow into one you understand.

To recap: a hash is a fixed-length, one-way fingerprint of data that changes completely whenever the input changes, making it perfect for verifying integrity and matching without revealing or recovering the original. It is not encryption and cannot be reversed. Use MD5 only for casual corruption checks and SHA-256 for anything security-related, and remember that hashing is what lets systems verify passwords and downloads without storing the secret itself. Understand the one-way fingerprint idea and hashing stops being mysterious and becomes one of the most useful tools in computing.