Hash Generator

A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size to a bit array of a fixed size. It is a one-way function, meaning it is practically impossible to reverse the process to find the original data.

• Deterministic: The same message always results in the same hash.
• Quick: It is fast to compute the hash for any given message.
• Avalanche Effect: A small change to a message changes the hash value so extensively that the new hash appears uncorrelated to the old hash.

A collision occurs when two different inputs produce the exact same hash output. Cryptographic hashes must be collision-resistant.

MD5 and SHA-1 have been mathematically broken because researchers proved they can generate collisions much faster than brute force. They should never be used for digital signatures or certificates, though they are still sometimes used for non-security checksums (like verifying a file downloaded correctly).

Modern browsers process hashes extremely fast using the native crypto.subtle.digest() API. It processes data locally in the browser memory using the OS's native cryptographic libraries.

const encoder = new TextEncoder();
const data = encoder.encode("hello");
const hashBuffer = await crypto.subtle.digest("SHA-256", data);
// Convert buffer to hex...

• Password Storage: Plain hashes (like SHA-256) are too fast and vulnerable to brute-force and rainbow table attacks. Always use a Key Derivation Function (KDF) like bcrypt, Argon2, or PBKDF2 with a salt for passwords.
• Length Extension Attacks: SHA-1, SHA-256, and SHA-512 are vulnerable to length extension attacks if used as a naive MAC (e.g., hash(secret || message)). Always use HMAC instead.

The Secure Hash Algorithms (SHA) are published by NIST. SHA-2 (which includes SHA-256 and SHA-512) is the current industry standard. SHA-3 is the newest standard (based on Keccak) offering different mathematical properties that make it immune to length-extension attacks.