Hash Algorithms Cheat Sheet

Q: Why does my hash differ from another tool's?

Usually the input differs: a trailing newline (echo adds one — use echo -n), different text encoding, or Windows line endings. Hex in upper vs lower case is the same hash.

Which hash to use, which are broken, how to check a file's checksum, how HMAC works, and why passwords need something else.

Cheat sheetPrintableFree, no login

Updated 28 October 2026

Hash text or files with MD5, SHA-1, SHA-256, SHA-384 and SHA-512, make HMACs, and check a hash.

Open the hash generator

Hash algorithms compared

Algorithm	Output	Hex length	Status	Use it for
MD5	128 bits	32	Broken — collisions made in seconds	Non-security checksums, cache keys
SHA-1	160 bits	40	Broken — collision shown in 2017	Legacy systems and Git object IDs only
SHA-256	256 bits	64	Secure	The default: file checksums, signatures, HMAC
SHA-384	384 bits	96	Secure	TLS, when a longer hash is required
SHA-512	512 bits	128	Secure	Fast on 64-bit CPUs, longer output
SHA3-256	256 bits	64	Secure	A different design from SHA-2, for diversity
BLAKE2b / BLAKE3	512 / 256 bits (defaults)	128 / 64	Secure	Very fast hashing of large data

Test values

Algorithm	Hash of the empty string	Hash of "abc"
MD5	`d41d8cd98f00b204e9800998ecf8427e`	`900150983cd24fb0d6963f7d28e17f72`	Try ↗
SHA-1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`	`a9993e364706816aba3e25717850c26c9cd0d89d`
SHA-256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`	`ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`

Use these to check that a hash function works. Seeing e3b0c442… in your logs usually means something hashed an empty input by mistake.

Hashing passwords

Never store passwords with MD5, SHA-1 or SHA-256 alone — even with a salt. They are designed to be fast, so attackers can test billions of guesses a second. Use a slow password-hashing function with a unique salt per password:

Function	Notes
Argon2id	The current first choice (winner of the Password Hashing Competition)
bcrypt	Widely supported. Use a cost of 12 or more; input is limited to 72 bytes
scrypt	Memory-hard; good when Argon2 isn't available
PBKDF2-SHA256	Use when FIPS compliance is required, with 600,000+ iterations

Try bcrypt in the bcrypt generator.

HMAC: hashing with a secret key

An HMAC is a hash mixed with a secret key. Only someone with the key can create or check it, so it proves a message wasn't changed and came from someone who knows the key — for example webhook signatures from Stripe or GitHub, and HS256 JWTs.

Example (RFC 2202 / RFC 4231 test): key Jefe, message what do ya want for nothing? → HMAC-SHA256 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
Don't build your own hash(key + message) — it's open to length-extension attacks with SHA-256. Use a real HMAC function.
Compare signatures with a constant-time function (hmac.compare_digest, crypto.timingSafeEqual), not ==.

Checksum a file from the command line

System	SHA-256 of a file	MD5 of a file
Linux	`sha256sum file.iso`	`md5sum file.iso`
macOS	`shasum -a 256 file.iso`	`md5 file.iso`
Windows (PowerShell)	`Get-FileHash file.iso -Algorithm SHA256`	`Get-FileHash file.iso -Algorithm MD5`
Windows (cmd)	`certutil -hashfile file.iso SHA256`	`certutil -hashfile file.iso MD5`
OpenSSL (any)	`openssl dgst -sha256 file.iso`	`openssl dgst -md5 file.iso`

To check a download, compare the result with the hash published on the download page — or drop the file into the hash generator and paste the expected hash.

Hashing in code

Language	SHA-256 (hex)	HMAC-SHA256 (hex)
Node.js	`crypto.createHash('sha256').update(s).digest('hex')`	`crypto.createHmac('sha256', key).update(s).digest('hex')`
Browser JS	`await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s))` (returns bytes)	`crypto.subtle.sign('HMAC', key, data)`
Python	`hashlib.sha256(data).hexdigest()`	`hmac.new(key, data, hashlib.sha256).hexdigest()`
Go	`sha256.Sum256(data)`	`hmac.New(sha256.New, key)`
Java	`MessageDigest.getInstance("SHA-256").digest(bytes)`	`Mac.getInstance("HmacSHA256")`
PHP	`hash('sha256', $s)`	`hash_hmac('sha256', $s, $key)`
C# (.NET)	`SHA256.HashData(bytes)`	`HMACSHA256.HashData(key, bytes)`

Frequently asked questions

Can a hash be reversed?

No. A hash is one-way. But short or common inputs (like passwords) can be found by guessing and comparing, which is why passwords need slow, salted hashing.

Is MD5 still safe to use?

Not for anything security-related — collisions can be made in seconds. It's still fine for non-security checks like spotting accidental file corruption or cache keys.

What is the difference between SHA-256 and SHA-512?

SHA-512 gives a longer output (128 hex characters vs 64) and is often faster on 64-bit CPUs. Both are secure; SHA-256 is the more common default.

What is a salt?

A random value stored with each password hash and mixed into it, so two users with the same password get different hashes and precomputed tables don't work. Argon2, bcrypt and scrypt add salts for you.

Why does my hash differ from another tool's?

Usually the input differs: a trailing newline (echo adds one — use echo -n), different text encoding, or Windows line endings. Hex in upper vs lower case is the same hash.