Hashing Explained — MD5, SHA-256 & Password Hashing
A hash is a one-way fingerprint: any input — a file, a password, a sentence — crushes down to a fixed-length string, and the same input always produces the same fingerprint while any change scrambles it completely. That single property powers file verification, password storage, blockchain and integrity checks. But "hash" covers a family of algorithms with wildly different security properties, and using the wrong one for the job is how password databases get breached. This guide covers the whole family and how to use LND AI’s free hash converter.
What hashing actually is
A hash function takes input of any size and produces output of fixed size — SHA-256 always emits 256 bits (64 hex characters) whether you hash one letter or an entire movie. Three properties make it useful: determinism (same input, same output, always), avalanche (flip one input bit and roughly half the output bits change), and one-wayness (from the hash alone, there is no practical path back to the input). It is a fingerprint, not an encryption — there is no key and no decryption.
Because it is deterministic, hashing answers the question "is this exactly the same as that?" without ever revealing what "this" is. That is why software downloads publish checksums, why Git identifies commits by hash, and why databases store password hashes instead of passwords — the login check recomputes the fingerprint and compares, without the server ever holding the password itself.
The algorithm family and their jobs
| Algorithm | Built for | Safe for passwords? |
|---|---|---|
| MD5 | Fast checksums, legacy deduplication | No — collisions are trivial to manufacture |
| SHA-1 | Legacy integrity (being phased out) | No — collisions demonstrated publicly |
| SHA-256 | Modern integrity, signatures, fingerprints | No — too fast; built to be fast |
| SHA-512 | 64-bit-optimised sibling of SHA-256 | No — same reason |
| PBKDF2-HMAC-SHA256 | Deliberately slow password hashing | Yes — with high iteration counts and salt |
| Bcrypt | Deliberately slow, memory-tuned password hashing | Yes — adaptive cost, salt built in |
Salting — why identical passwords must not match
Without salt, password123 hashes to one identical value in every database on earth, and attackers simply look it up in precomputed rainbow tables. A salt is random data mixed into each hash — the same password under two different salts produces two completely different hashes, and rainbow tables become worthless because every entry must be recomputed per-salt. Store the salt alongside the hash (it is not a secret — it only needs to be unique) and verify by re-hashing with the stored salt.
- Generate a fresh random salt per password — never share salts across users.
- Salt length ≥ 16 bytes — enough randomness that an attacker cannot enumerate plausible salts.
- Do not use predictable "salts" like usernames or timestamps — predictability re-enables precomputation.
Using LND AI Hash Converter, step by step
- Open the toolGo to namansoni.in/hash-converter — completely free, no sign-up, and hashing runs locally in your browser.
- Enter your inputAny text — a string to fingerprint, a password to experiment with, a value to verify.
- Pick algorithmsGenerate MD5, SHA-1, SHA-256 and SHA-512 side by side, or use PBKDF2-HMAC-SHA256 and Bcrypt for real password work.
- Add saltUse the salt options to see how salting changes outputs — and to produce properly salted password hashes.
- Copy the digestTake the hash you need. One-way guarantee intact: nothing anywhere stores what produced it.
Everyday uses worth knowing
- File integrity: hash a downloaded file and compare against the publisher’s checksum — any corruption or tampering shows instantly.
- Deduplication: identical files hash identically — how storage systems and photo libraries detect duplicates without comparing contents.
- Password storage: slow salted hashes (Bcrypt/PBKDF2) — the only acceptable pattern.
- Change detection: commit hashes, document versioning, cache invalidation — all fingerprints of content.
Frequently asked questions
What is the difference between hashing and encryption?
Encryption is two-way and keyed: with the right key you recover the original. Hashing is one-way and keyless: the hash is a fixed-size fingerprint from which the input cannot be practically recovered — there is nothing to "decrypt" into. You encrypt secrets you need back; you hash data you only need to verify or compare.
Why is MD5 not safe anymore?
MD5’s collision resistance is broken — attackers can deliberately craft two different inputs with the same MD5 hash, which was demonstrated publicly with crafted documents years ago. It remains fine as a casual checksum for accidental corruption, but it must never back signatures, certificates or anything an adversary could engineer collisions against. SHA-256 is the modern replacement for integrity.
Why are Bcrypt and PBKDF2 better for passwords than SHA-256?
Because they are slow on purpose. SHA-256 is engineered for speed — a GPU computes millions per second, making brute-force password guessing cheap. Bcrypt and PBKDF2 are engineered to be expensive (Bcrypt’s adaptive cost, PBKDF2’s iteration count), turning a brute-force attack from hours into years. For passwords, slow is the feature.
What is a salt and why do passwords need one?
A salt is random data mixed into each password hash so identical passwords produce different fingerprints. Without it, "password123" hashes identically everywhere and precomputed rainbow tables crack it instantly. With a unique per-user salt, every table entry must be recomputed per salt, making precomputation worthless. Salts are stored alongside the hash — uniqueness matters, secrecy does not.
Can a hash be reversed to reveal the original input?
No — not by computation. Hashing is one-way: the output does not contain enough information to reconstruct the input. What attackers do instead is guess: hash candidate inputs until one matches. Strong passwords plus slow, salted hashing makes that guessing astronomically expensive.
How do I verify a file download with a hash?
Hash the downloaded file with the same algorithm the publisher used (usually SHA-256) and compare the digest character-by-character against the published checksum. Identical means the file is bit-for-bit what the publisher shipped; any difference — corruption or tampering — changes the hash completely.