Generating hashes, and knowing which ones are still safe to use
MD5 is fine for checking a download. It is completely unfit for passwords, and so is SHA-256 on its own.
A hash turns any input into a fixed-length fingerprint. The same input always gives the same hash, and you cannot work backwards from the hash to the input. That makes hashes useful for verifying that a file downloaded intact, or that two things are identical without comparing them byte by byte.
Where people go wrong is passwords. MD5 and SHA-1 are cryptographically broken and should not be used for anything security-related. But even SHA-256 is wrong for passwords, because it is fast, and fast is exactly what an attacker wants when guessing billions of candidates. Passwords need a deliberately slow algorithm like bcrypt or Argon2. The hash generator is in ToolHub.
Hash Generator: the facts that matter
| Algorithms | MD5, SHA-1, SHA-256, SHA-512 |
| MD5 and SHA-1 | Broken. Checksums only, never security |
| SHA-256 | Current standard for integrity |
| Passwords | Need bcrypt or Argon2, not a plain hash |
| Reversible | No, by design |
How to do it, step by step
- 1Open the hash generator in ToolHub.
- 2Pick the algorithm. SHA-256 for anything current; MD5 only for non-security checksums.
- 3Paste your input or upload the file.
- 4For verifying a download, compare against the published hash character by character, or paste both and diff them.
- 5Never use this to hash passwords for storage. Use bcrypt or Argon2 in your application.
Three things worth knowing
- SHA-256 for integrity, bcrypt or Argon2 for passwords. Two different jobs, two different tools.
- Verifying a download hash is the one security habit that costs ten seconds and actually works.
- Getting this wrong in production is a real incident. CodeAiMan's cloud and DevOps work covers secrets handling and deployment hardening.
Common problems, solved
Where to run it
This tool is part of the ToolHub tool library, a library of over 1,000 browser-based tools covering PDF, image, video, audio, text and developer work. Everything runs in the browser and none of it needs an account.
ToolHub is built by codaiman.com, an AI-first software company in Ahmedabad. Related to this page: Cloud and DevOps aws, azure and gcp infrastructure with docker, kubernetes, ci/cd and infrastructure as code.
Hash Generator, in the browser: no install, no sign-up, no upload queue. Part of the ToolHub library from CodeAiMan.
Open ToolHubRelated tools
Base64 Encoder / Decoder
Base64 is encoding, not encryption. Anyone can decode it instantly, which matters more than most people realise.
Read guideJSON Formatter
Four mistakes cause almost every JSON parse error. Trailing commas top the list.
Read guideURL Encoder / Decoder
Spaces, ampersands and question marks break URLs. Encoding fixes it, and double-encoding breaks it differently.
Read guide