Hash Functions Explained: SHA-256, Checksums, and HMAC
One-way digests for file integrity, API signatures, and why MD5 is not enough for security.
Hash functions compress arbitrary data into fixed-length fingerprints—MD5, SHA-256, and friends power checksums, git commits, password storage (with proper algorithms), and HMAC API signatures. They are one-way: you cannot recover the input from the digest, which is exactly why they work for integrity verification.
What hashing actually does
A hash algorithm maps input of any size to a deterministic output of fixed length. Change one bit of input and the digest changes unpredictably (avalanche effect). Identical input always yields identical output—useful for deduplication and integrity checks.
- MD5: 128-bit, fast, broken for security—OK for non-adversarial checksums
- SHA-1: deprecated for certificates, still seen in legacy systems
- SHA-256: modern default for integrity and blockchain-adjacent work
- SHA-512: longer digest, different performance profile on 64-bit CPUs
Checksums and file integrity
Download pages publish SHA-256 hashes so you verify the file was not corrupted or tampered with in transit. Compare your local hash to the published value—match means bytes are identical.
- 1
Hash the downloaded file
Stream bytes through SHA-256 in your browser or terminal.
- 2
Compare to publisher hash
Case-insensitive hex comparison; any difference means re-download.
- 3
Store hashes in version control
Lock dependency integrity with known-good digests.
HMAC for API authentication
HMAC combines a hash function with a secret key. Both sender and receiver know the key; the digest proves the message was not altered and came from someone with the key. Webhooks from Stripe, GitHub, and Slack use HMAC-SHA256 signatures in headers.
Hash text and files locally
The Hash Generator on XSular Tools computes MD5, SHA-1, SHA-256, and SHA-512 from text or uploaded files, supports HMAC mode, and runs entirely in your browser via the Web Crypto API.
Try it now
Hash Generator — Free Online MD5 & SHA Calculator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or uploaded files with optional HMAC support. Powered by the Web Crypto API — instant results, nothing uploaded. Free browser-based hash calculator for developers.
Related posts
Practical articles on writing, development, design, and productivity — each tied to a free XSular tool you can use right away.
What Makes a Strong Password in 2025?
A complete guide to password security, common mistakes, and how to protect your accounts.
Jan 22, 2025Unix Timestamps Explained for Non-Developers
What is a Unix timestamp, why it starts at 1970, and how to convert them easily.
Jan 28, 2025Binary Numbers Explained for Beginners
How computers think in 0s and 1s, and how to convert text to binary yourself.
Feb 3, 2025