A hash maps any input to a fixed-length digest. The same input always produces the same digest; changing one bit changes roughly half the output bits. What varies between algorithms is whether an attacker can find two inputs that collide.
Which algorithm
SHA-256 — the default for essentially everything. Fast, universally supported, no practical attacks.
SHA-512 — larger digest, and often *faster* than SHA-256 on 64-bit hardware because it operates on 64-bit words. Worth choosing when you have the choice.
SHA3-256 / SHA3-512 — a completely different internal construction (Keccak's sponge, not Merkle–Damgård). Not stronger than SHA-2 in practice, but immune to length-extension attacks and useful as a hedge against a future SHA-2 break.
Keccak-256 — Keccak with the original pre-standard padding. Not the same as SHA3-256, and the two produce different digests for identical input. This is the one Ethereum uses.
SHA-1 — collisions are practical and have been demonstrated. Legacy verification only.
MD5 — chosen-prefix collisions are cheap. Fine for detecting accidental file corruption, useless against an adversary.
Length extension, and why it matters
SHA-1, SHA-256 and SHA-512 are Merkle–Damgård constructions. Given hash(secret + message) and the length of secret, an attacker can compute hash(secret + message + padding + extra) without knowing the secret at all.
This breaks the naive authentication scheme token = sha256(secret + data). Use HMAC, which is specifically constructed to resist this — see the HMAC generator. SHA-3 is immune by construction, but HMAC is the correct answer regardless.
Hashing API keys for storage
For a random 256-bit API key, a single SHA-256 is the right choice. The key already has full entropy, so there is no guess space for a slow hash to defend. Adding bcrypt here costs you latency on every authenticated request and buys nothing.
For a human-chosen password, the opposite is true — see PBKDF2 key derivation.
Input format matters
Hashing the *text* deadbeef and hashing the four *bytes* 0xDE 0xAD 0xBE 0xEF produce entirely different digests. When comparing a digest against another system, confirm you are both hashing the same bytes. The input format selector exists for this.
Frequently asked questions
Is MD5 completely useless?
For security, yes. For detecting whether a file transfer corrupted, it is fine and fast — accidental corruption is not adversarial. Never use it where someone might deliberately construct a collision.
Is SHA-3 more secure than SHA-256?
Not meaningfully today; both are unbroken. SHA-3 is structurally different, so a breakthrough against SHA-2 would not automatically apply. It is a diversification argument, not a strength argument.
Why do SHA3-256 and Keccak-256 give different results?
The padding differs. NIST changed the domain separator when standardising SHA-3, after Keccak had already been deployed. Ethereum uses the original. Same permutation, different digest.
Can I hash a file?
Not here — this takes text, hex or Base64 input. For files, use shasum -a 256 file or certutil -hashfile file SHA256 locally, which also avoids loading a large file into a browser tab.