What hashes are for
A cryptographic hash turns any input into a fixed-length fingerprint. The same input always produces the same output, and even a one-character change produces a completely different hash. Typical uses include checking file integrity, building cache keys, de-duplicating content and verifying webhook signatures (combined with a secret as HMAC).
Which algorithm?
- SHA-256: the sensible default for integrity checks and signatures.
- SHA-384 / SHA-512: longer outputs; SHA-384 is used for Subresource Integrity attributes.
- SHA-1: broken for collision resistance. Use it only for legacy compatibility, such as Git object IDs.
- MD5: not offered here; it's unsuitable for anything security-related.
Don't hash passwords with SHA. Use a slow, salted password hash such as Argon2id, scrypt or bcrypt, because fast hashes can be brute-forced at billions of guesses per second.