What Is a Hash Function? SHA-256, MD5, and bcrypt Explained
A deep dive into cryptographic hash functions — how they work, why MD5 and SHA-1 are broken for security, and when to use bcrypt or Argon2 for passwords.
A hash function takes an input of any size — a single character, a 10 GB file, a password — and produces a fixed-length output called a digest or hash. The same input always produces the same output, but even a one-character change produces a completely different hash. This property is called the avalanche effect.
Hash functions are everywhere in security: verifying file integrity, storing passwords, signing code, and building data structures like Merkle trees. Understanding which hash function to use — and when — is foundational knowledge for any security practitioner.
The four properties of a secure hash function
The same input always produces the same output. This is what makes hashes useful for verification — you can re-hash a file and compare digests to confirm it hasn't changed.
Given a hash H, it should be computationally infeasible to find any input M such that hash(M) = H. This is what makes hashes safe for password storage — an attacker who steals the hash can't reverse it to get the password.
It should be computationally infeasible to find two different inputs that produce the same hash. A collision breaks the integrity guarantee — an attacker could swap a malicious file for a legitimate one with the same hash.
A single bit change in the input should change approximately 50% of the output bits. This prevents attackers from making small modifications to inputs and predicting how the hash will change.
MD5, SHA-1, SHA-256, and SHA-3 — what's the difference?
MD5 was designed in 1991 and produces a 128-bit (32 hex character) digest. Collision attacks were demonstrated in 2004 — researchers can generate two different files with the same MD5 hash in seconds on modern hardware. Never use MD5 for security purposes. It's still acceptable for non-security checksums (detecting accidental corruption) where collision resistance isn't required.
SHA-1 produces a 160-bit digest. Google's SHAttered attack (2017) produced the first practical SHA-1 collision. Major browsers and certificate authorities stopped accepting SHA-1 certificates in 2017. Do not use SHA-1 for digital signatures, certificates, or any security-critical application.
Part of the SHA-2 family, SHA-256 produces a 256-bit digest. No practical collision attacks exist. It's the current standard for file integrity, digital signatures (TLS certificates, code signing), and blockchain (Bitcoin uses SHA-256 for proof-of-work). Use SHA-256 for general-purpose integrity verification.
SHA-3 is based on the Keccak sponge construction — a completely different design from SHA-2. It was standardized in 2015 as a hedge against future weaknesses in SHA-2. SHA-3-256 produces a 256-bit digest. Use SHA-3 when you need algorithm diversity or are working in contexts that specifically require it.
Why you should never use SHA-256 for passwords
SHA-256 is fast — that's a feature for file integrity, but a critical flaw for password hashing. A modern GPU can compute billions of SHA-256 hashes per second. An attacker who steals a database of SHA-256 password hashes can run a dictionary attack against all of them simultaneously at enormous speed.
Password hashing functions like bcrypt, Argon2, and scrypt are intentionally slow and memory-hard. bcrypt has a configurable cost factor — increasing it by 1 doubles the computation time. A bcrypt hash that takes 100ms to compute means an attacker can only test 10 passwords per second per thread, instead of billions.
Argon2 (winner of the Password Hashing Competition in 2015) is the current recommendation. It has three variants: Argon2d (GPU-resistant), Argon2i (side-channel resistant), and Argon2id (hybrid, recommended for most use cases). Use Argon2id with at least 64MB of memory, 3 iterations, and 4 parallelism threads for new systems.
Practical applications
Download a file, compute its SHA-256 hash, and compare it to the hash published by the software vendor. If they match, the file hasn't been tampered with in transit. This is how Linux distributions verify ISO downloads.
Every Git commit is identified by a SHA-1 hash of its content, parent commit, author, and timestamp. This creates an immutable chain — changing any commit changes its hash and all subsequent commit hashes.
When creating a forensic disk image, investigators compute an MD5 or SHA-256 hash of the original drive and the image. Matching hashes prove the image is an exact copy and establish chain of custody.
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a message authentication code. It's used in API authentication (AWS Signature, JWT HS256) to verify that a message came from someone who knows the key and hasn't been modified.
Try it in the Hash Workbench
Generate SHA-256, SHA-3, MD5, and bcrypt hashes directly in your browser. Compare outputs, test the avalanche effect, and verify file integrity — no installation required.
Open Hash Workbench