Every hash algorithm does the same basic job: take an input of any size and produce a fixed-length string that represents it. Feed it the same input twice, get the same output twice. Change one character of the input, and the output changes completely. That part is true of MD5, SHA-1, SHA-256, and SHA-512 alike. What's not the same is how safe each one is to rely on.
The short version
- MD5 — fast, widely supported, and broken for security purposes. Researchers have been able to deliberately construct two different files that produce the same MD5 hash (called a "collision") since 2004. Fine for a quick "did this file change" check; never use it for passwords, signatures, or anything an attacker might want to forge.
- SHA-1 — better than MD5, but also broken. Google demonstrated a practical collision attack against SHA-1 in 2017. Most browsers and certificate authorities stopped trusting it years ago.
- SHA-256 — part of the SHA-2 family, and the current practical default for anything security-sensitive: password hashing (usually wrapped in something slower like bcrypt or Argon2, not used raw), file integrity checks, digital signatures, blockchain, you name it. No known practical collision attack.
- SHA-512 — same family as SHA-256, longer output, marginally slower on 32-bit systems but often faster on modern 64-bit hardware. Cryptographically in the same safe category as SHA-256; the choice between them usually comes down to output length requirements, not security.
"Collision-resistant" — what that actually means
A hash function is supposed to make it computationally infeasible to find two different inputs that produce the same output. When researchers find a way to do that faster than brute force, the algorithm is considered "broken" — not because the hash stops working, but because someone could now construct a malicious file that hashes identically to a legitimate one, defeating the entire point of using a hash to verify integrity in the first place.
One-way, not reversible
None of these can be "decrypted" back to the original input — that's not how hashing works, for any of the four. A hash lets you check whether some text matches a known hash (hash it yourself and compare), not recover what the text was from the hash alone. If you see a service claiming to "decrypt" an MD5 hash, what it's actually doing is checking the hash against a huge precomputed table of common passwords and dictionary words — it only works if the original input was something predictable enough to already be in that table.
Using the tool
Our Hash Generator computes all four — MD5, SHA-1, SHA-256, and SHA-512 — from the same input at once, so you can copy whichever one you actually need without re-running anything. For anything security-sensitive, reach for SHA-256 or SHA-512. For a quick "does this file match" checksum where nobody's trying to forge it, any of the four will tell you what you need to know.
Try it here: Hash Generator.