Hash Generation and Verification: MD5, SHA, and Beyond
Hash functions produce fixed-size fingerprints of data for integrity verification, password storage, and deduplication. This guide covers the most common algorithms and their appropriate uses.
Key Takeaways
- When downloading software, compare the published hash with the hash of your downloaded file.
- macOS/Linux: `shasum -a 256 file.txt`
- Important: Compare hashes in constant time to prevent timing attacks in security contexts.
- If they match exactly, the file is unmodified Important: Compare hashes in constant time to prevent timing attacks in security contexts.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, SHA-512 hashes from text
Common Hash Algorithms
| Algorithm | Output | Speed | Status |
|---|---|---|---|
| MD5 | 128-bit (32 hex chars) | Very fast | Broken (do not use for security) |
| SHA-1 | 160-bit (40 hex chars) | Fast | Deprecated (collision attacks exist) |
| SHA-256 | 256-bit (64 hex chars) | Moderate | Secure (current standard) |
| SHA-512 | 512-bit (128 hex chars) | Moderate | Secure (longer output) |
| BLAKE3 | 256-bit (64 hex chars) | Very fast | Secure (newest) |
When to Use Each
File Integrity (Checksums)
When downloading software, compare the published hash with the hash of your downloaded file. SHA-256 is the standard for this purpose. MD5 is still used for legacy compatibility but should not be relied upon for security.
Content Deduplication
Hash file contents to detect duplicates. If two files produce the same SHA-256 hash, they are identical (with overwhelming probability). This is how Git identifies unchanged files.
Data Integrity in Transit
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to verify both integrity and authenticity of data in transit. APIs use HMAC-SHA256 for webhook signature verification.
Generating Hashes
Command Line
- macOS/Linux:
shasum -a 256 file.txt - Windows:
certutil -hashfile file.txt SHA256
In Code
Every major language has a built-in library: hashlib (Python), crypto (Node.js), MessageDigest (Java), sha2 crate (Rust).
Verification Process
- Obtain the expected hash from a trusted source
- Compute the hash of the received file
- Compare the two strings
- If they match exactly, the file is unmodified
Important: Compare hashes in constant time to prevent timing attacks in security contexts. Use hmac.compare_digest() in Python, not ==.