Which hash to use in 2026
- MD5 — broken for cryptographic purposes since 2005. Still widely used for file integrity checksums, cache keys, and deduplication where collision-resistance against an adversary is not required. Do not use for passwords or signatures.
- SHA-1 — collisions demonstrated in 2017 (SHAttered). Deprecated for digital signatures. Still fine for Git object IDs (not a security-critical use) and legacy compatibility.
- SHA-256 — the current default for most general use. Bitcoin, TLS, most cryptographic protocols.
- SHA-384 / SHA-512 — slower but stronger. SHA-512 is often faster than SHA-256 on 64-bit hardware. Use when you need larger hash output.
Do not use these to hash passwords
MD5, SHA-1, SHA-256, and friends are "fast" hashes — designed to be computed quickly. That's the opposite of what you want for passwords, where slow = good (so attackers can't brute-force). For passwords, use bcrypt, argon2id, or scrypt. Never SHA a password and store it — that's a 2005-level mistake that still shows up in breaches.
What this tool doesn't do
No HMAC (needs a key — different tool), no password hashing (on purpose), no signing, no verification. For HMAC, crypto.subtle's API is straightforward but requires a secret key — not a fit for a tool where the key would be pasted into a web form.
FAQ
Why is SHA-512 the same speed or faster than SHA-256 for me?
SHA-512 processes 128-byte blocks instead of 64-byte. On 64-bit hardware (pretty much everything today), it often runs faster per byte.
Can I hash large files?
Yes — up to 100MB. Everything happens in your browser.
Are the hashes identical to command-line tools?
Yes. Compare to md5sum, sha256sum, openssl dgst -sha256 — byte-for-byte match.
Related tools
- JSON Formatter — Format, validate, and beautify JSON online. 100% client-side — your data never leaves your browser.
- Base64 Encoder / Decoder — Encode and decode Base64 strings and files. Client-side, safe for sensitive data.
- JWT Decoder — Decode and inspect JSON Web Tokens. Local-only — tokens never leave your browser.
- UUID Generator — Generate UUID v4 and v7 identifiers in bulk.
Pillar
Part of Encoding & Crypto — Base64, URL, JWT, hashes, UUID, QR, password.
Written by Mian Ali Khalid. Last updated 2026-04-25.