Hashing & Cryptographic Digests

What is Hashing?

A hash function takes an input of any size and produces a fixed-length output (the "digest"). Cryptographic hash functions are one-way, you cannot reverse a hash back to the original input. They are used for data integrity, password storage, and digital signatures.

Common Hash Algorithms

• MD5: 128-bit, fast but broken for security. Use only for checksums.
• SHA-1: 160-bit, deprecated for security. Collision attacks demonstrated.
• SHA-256: 256-bit, part of SHA-2 family. Widely used and recommended.
• SHA-512: 512-bit, stronger variant. Faster on 64-bit systems.

HMAC. Keyed Hashing

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to verify both integrity and authenticity. Used in API authentication, JWT signatures, and webhook verification.

HMAC-SHA256("message", "secret-key")
→ 2c26b46b68ffc68ff99b453c1d30413413422d706483...

Code Examples

// JavaScript (Web Crypto API)
const data = new TextEncoder().encode("Hello");
const hash = await crypto.subtle.digest("SHA-256", data);

// Node.js
const crypto = require("crypto");
crypto.createHash("sha256").update("Hello").digest("hex");

// HMAC in Node.js
crypto.createHmac("sha256", "secret").update("Hello").digest("hex");

Common Mistakes

• Using MD5/SHA-1 for security: these are broken. Use SHA-256 or better.
• Hashing passwords without salt: always use bcrypt, scrypt, or Argon2 for passwords.
• Comparing hashes with ==: use constant-time comparison to prevent timing attacks.

Generate hashes with our Hash Generator or verify with the Hash Compare Tool.