Question 1

What is a cryptographic hash function?

Accepted Answer

A hash function takes any input and produces a fixed-length output (the hash or digest) with three key properties: deterministic (same input → same output), one-way (cannot reverse the hash to get the input), and collision-resistant (practically impossible to find two inputs with the same hash).

Question 2

What is the difference between MD5, SHA-1, and SHA-256?

Accepted Answer

MD5 produces a 128-bit hash; SHA-1 produces 160 bits; SHA-256 produces 256 bits. MD5 and SHA-1 are cryptographically broken — known collision attacks exist. SHA-256 (part of SHA-2) is currently secure and recommended for security applications. SHA-512 provides 512 bits for the highest security margin.

Question 3

What is SHA-256 used for?

Accepted Answer

SHA-256 is used in: Bitcoin and blockchain proof-of-work, TLS/SSL certificates (digital signatures), file integrity verification (checksums), password hashing (as part of bcrypt/PBKDF2), HMAC message authentication codes, and git commit hashes.

Question 4

Can I use SHA-256 to hash passwords?

Accepted Answer

Do not use plain SHA-256 for password hashing — it is too fast, making brute-force and rainbow table attacks feasible. Instead, use slow password-hashing functions: bcrypt, scrypt, or Argon2. These are designed specifically for passwords and are built into most web frameworks.

Question 5

What is the difference between hex and base64 encoding?

Accepted Answer

Both represent the same binary hash data in different text formats. Hex uses characters 0–9 and a–f, producing a longer string (SHA-256 = 64 hex chars). Base64 uses A–Z, a–z, 0–9, + and /, producing a shorter string (SHA-256 = 44 base64 chars). Base64 is more compact; hex is more readable.

Question 6

What is an HMAC and how is it different from a plain hash?

Accepted Answer

HMAC (Hash-based Message Authentication Code) combines a hash with a secret key: HMAC = hash(key + message). A plain hash only verifies data integrity (the data hasn't changed). HMAC additionally verifies authenticity (the sender knows the secret key). Used in API authentication, JWT signing, and webhook verification.

Question 7

How do I verify a file's checksum?

Accepted Answer

The file download page shows the expected SHA-256 hash. Compute the hash of your downloaded file and compare them character by character. If they match, the file is intact and unmodified. If they differ, the file is corrupted or tampered with and should be re-downloaded.

Hash Generator

How to Use Hash Generator

About Hash Generator

Frequently Asked Questions

JSON Formatter

Base64 Encoder / Decoder

URL Encoder / Decoder

Password Generator

Color Converter

Unix Timestamp Converter

You Might Also Like

Word Counter

Character Counter

Percentage Calculator