A hash function takes any input and produces a fixed-length string — a "fingerprint" of the data. The same input always gives the same hash, but you can't reverse a hash back to the original.
The SHA family (SHA-1, SHA-256, SHA-512) is the most widely used. Hashes are used to verify file integrity, store passwords safely and sign data.
Generate SHA hashes of any text in your browser.
What a hash function does
A hash function takes input of any length and produces a fixed-length value. The same input always gives the same output, a one-character change gives a completely different output, and the process cannot be run backwards — you cannot recover the input from the digest. Those three properties are what make hashes useful for verifying that two things are identical without comparing them directly.
What hashes are used for
Verifying downloads, by comparing the digest of the file you received against the one the publisher advertised. Detecting whether a file or record has changed, without storing a copy of it. Deduplicating data by comparing digests rather than contents. Indexing in hash tables. And, with the right algorithm, storing passwords in a form that a database breach does not immediately hand to an attacker.
Which algorithm to use
SHA-256 for general integrity work. MD5 and SHA-1 are cryptographically broken — deliberate collisions have been demonstrated for both — and should only be used against legacy checksums where you have no choice, never where an adversary could benefit from forging a match. MD5 remains fine as a fast non-security fingerprint for deduplication, and only that.
Never hash passwords with these
This is the most important caveat and the most commonly ignored. SHA-256 is designed to be fast, which is exactly wrong for passwords: speed lets an attacker try billions of guesses per second against a stolen database. Password storage needs a deliberately slow, salted, memory-hard algorithm — bcrypt, scrypt or Argon2 — with a per-user salt so identical passwords do not produce identical digests. Nothing in a browser tool is appropriate for real password storage, which belongs on a server.
Collisions
Because inputs are unlimited and outputs are fixed-length, two different inputs must eventually share a digest. For a well-designed 256-bit hash, finding such a pair is computationally infeasible, which is what makes the guarantee practical rather than absolute. When a hash function is described as broken, it means someone found a shortcut to producing collisions deliberately.