MD5 vs SHA-1 vs SHA-256: what hashing actually does

A hash function takes an input of any size and produces a fixed-length output — the "hash" or "digest" — such that the same input always produces the same output, but even a tiny change to the input produces a completely different output. Crucially, a good hash function is one-way: there's no practical way to reconstruct the original input just from its hash.

What hashes are actually used for

• File integrity — comparing a hash of a downloaded file against a published hash confirms the file wasn't corrupted or tampered with in transit.
• Password storage — a service should never store your actual password, only a hash of it (plus additional protections — more on that below).
• Deduplication — quickly checking whether two large files are identical by comparing short hashes instead of the full contents.
• Digital signatures and blockchain — both rely heavily on hash functions as a building block.

MD5 and SHA-1 are broken for security purposes

Both MD5 and SHA-1 have known practical collision attacks — meaning researchers have demonstrated constructing two different inputs that produce the same hash. That breaks the core guarantee a security-relevant hash needs to provide. Neither should be used for passwords, digital signatures, or anything where an attacker deliberately trying to fake a match is a real threat. They're still fine for non-adversarial uses like a basic file-integrity checksum where nobody is actively trying to fool the check.

SHA-256 (and beyond)

SHA-256, part of the SHA-2 family, has no known practical collision attack and is the current standard for security-relevant hashing — TLS certificates, blockchain, and most modern integrity checks use it. SHA-3, a newer family with a different internal design, is also considered strong and is used where an additional hedge against future SHA-2 weaknesses is wanted.

A hash isn't enough for passwords on its own

Plain SHA-256 of a password is still vulnerable to precomputed lookup tables (rainbow tables) for common passwords, since the same password always hashes to the same value. Proper password storage adds a random "salt" per user and uses a deliberately slow hashing algorithm designed for this purpose (bcrypt, scrypt, or Argon2) rather than a fast general-purpose hash like SHA-256 alone.

Processa's hash generator computes MD5, SHA-1, SHA-256 and SHA-512 for any text or file, side by side — useful for verifying downloads or just seeing how different algorithms handle the same input.