Is a hash reversible?

No. A good hash is one-way, so you cannot recover the original input from the digest — you can only re-hash a guess and compare.

Why is MD5 considered broken?

Practical collisions exist — two different inputs that produce the same MD5 hash — so it can no longer be trusted where security matters.

Should I hash passwords with SHA-256?

No. Use a slow, salted password hash such as bcrypt or Argon2 — they resist brute-force attacks far better than a fast general-purpose hash.

What Is a Hash Function? (MD5, SHA-256)

Published 10/2/2025 · 2 min read · Developer tools

Daniel Okonkwo — Front-end developer and tech writer at Allin

Web performance · File formats

Checked against 2 sources

View profile →

In short

A hash function turns any input into a fixed-size string of characters — its 'hash' or 'digest'. The same input always gives the same hash, but you can't reverse it to recover the input, and any tiny change produces a completely different result. SHA-256 is a modern, secure choice; MD5 and SHA-1 are broken for security and should be used only for non-security checksums.

A hash function turns any input into a fixed-size fingerprint. Here's what it does, its key properties, common uses, and which algorithms are safe.

What it does

A hash function takes data of any size — a word, a document, a whole disk image — and maps it to a fixed-length string, such as the 64 hex characters of a SHA-256 digest. That output is deterministic: the same input always yields exactly the same hash. Think of it as a fingerprint for data, compact and unique to what produced it.

Key properties

Good cryptographic hashes share a few traits. They are one-way: you cannot work backwards from the digest to the input. They show the avalanche effect: change one bit and the whole hash changes. And they resist collisions: it should be infeasible to find two different inputs with the same hash. Together these make a hash a trustworthy stand-in for the data itself.

Common uses

Hashes verify integrity: publish a file's hash, and anyone can re-hash their download to confirm it wasn't altered. They underpin digital signatures and blockchains, and they deduplicate data by fingerprint. Passwords are stored as hashes too — but with a random salt and a deliberately slow algorithm, so a stolen database is far harder to crack.

MD5, SHA-1, SHA-256

MD5 and SHA-1 are old and broken: researchers can produce collisions, so they are no longer trustworthy for security, though they remain fine as quick checksums for accidental corruption. SHA-256 (part of the SHA-2 family) is the current safe default for integrity and signatures. For passwords specifically, don't use a plain fast hash at all — use a slow, salted one like bcrypt or Argon2.

Hash generatorCompute 15 hashes (MD5, SHA-256, SHA-3, CRC-32…) of a text or a file.Try the tool →

Frequently asked questions

Is a hash reversible?: No. A good hash is one-way, so you cannot recover the original input from the digest — you can only re-hash a guess and compare.
Why is MD5 considered broken?: Practical collisions exist — two different inputs that produce the same MD5 hash — so it can no longer be trusted where security matters.
Should I hash passwords with SHA-256?: No. Use a slow, salted password hash such as bcrypt or Argon2 — they resist brute-force attacks far better than a fast general-purpose hash.

Articles you may find interesting

All guides →

ExplainerWhat Is a UUID (and When to Use It)?A UUID is a 128-bit identifier that's unique without any central authority. Here's what it looks like, why it's useful, the versions, and when to use one.ExplainerWhat Is a QR Code?A QR code is a 2D barcode a camera reads to open a link or text. Here's what it is, why it holds so much, its anatomy, and a safety note on scanning.ExplainerWhat Is a JWT (JSON Web Token)?A JWT is a compact, signed token used to carry identity between services. Here's its three parts, how it's used for auth, and its security limits.ExplainerWhat Is a Cron Expression?A cron expression schedules a task to run automatically at set times. Here's what it's for, its five fields, how to read one, and the common gotchas.How-toHow to Create a Strong PasswordLength beats complexity. Here's why a four-word passphrase is strong, why you should never reuse a password, and how a manager makes it effortless.ExplainerWhat Is Base64 Encoding?Base64 turns binary data into safe text. Here's what it does, why it exists, why it isn't encryption, and the size cost it adds.

Sources

Spotted a mistake in this article?