Question 1

Is MD5 or SHA-1 safe to use for passwords?

Accepted Answer

No. Both are broken for security purposes — MD5 and SHA-1 collisions are practical to generate today, and neither is designed to be slow, which is what password hashing needs to resist brute-force guessing. They're included here for checksums, cache keys, and compatibility with older systems, not for hashing passwords or anything security-sensitive. Use a purpose-built algorithm like bcrypt or Argon2 for passwords instead.

Question 2

Why does the same input always produce the same hash?

Accepted Answer

That's the defining property of a hash function — deterministic output. It's also why hashes are used to verify file integrity: hash a file before and after a transfer, and matching hashes mean the bytes are identical.

Question 3

What’s the difference between a hash and HMAC?

Accepted Answer

A plain hash (MD5, SHA-256) only proves the content — anyone can compute the same hash from the same input. HMAC mixes in a secret key, so it also proves the sender knew the secret, which is what makes it useful for verifying a message wasn't tampered with in transit, not just that it matches some known content.

Hash Generator

What each algorithm is for

Common questions