TL;DR: A hash is a fixed-length fingerprint calculated from your text. The same input always produces the same hash, but a single changed character produces a completely different one — which is exactly what makes hashes useful for spotting whether text or a file has changed. This guide explains what a hash is, which algorithm to pick (MD5, SHA-1, SHA-256, SHA-512), how to verify integrity in practice, and the security limits you should never ignore.
Hashing turns any amount of text — a word, a paragraph, or a whole document — into a short string of hexadecimal characters. Because the calculation is deterministic, you can run it twice and compare: identical hashes mean the input is byte-for-byte identical, and different hashes mean something changed, even if the two versions look the same on screen.
What exactly is a hash?
A cryptographic hash function has three properties that matter for everyday work. It is deterministic: the same input always yields the same output. It is fixed-length: hashing three words or three megabytes both produce a digest of the same size. And it shows the avalanche effect: changing one character — even swapping a trailing space — flips roughly half the output bits, so the new hash looks unrelated to the old one.
That last property is why hashes are a reliable change-detector. You cannot eyeball two long paragraphs and be sure they are identical, but you can compare two 64-character hashes in a second.
Which algorithm should you use?
The common algorithms differ mainly in digest length and in whether they are still considered secure:
- MD5 — 128-bit digest, 32 hex characters. Fast, but cryptographically broken (practical collisions exist). Fine for non-security checks like deduplication or cache keys; never for security.
- SHA-1 — 160-bit, 40 hex characters. Also broken by collision attacks; being retired across the industry.
- SHA-256 — 256-bit, 64 hex characters. Part of the SHA-2 family and the current sensible default for integrity checks.
- SHA-512 — 512-bit, 128 hex characters. A larger security margin; useful when you want extra headroom.
If you are not sure, choose SHA-256. It is widely supported, fast enough for text, and strong enough that a deliberate collision is not a realistic concern.
How to check text integrity in practice
The workflow is simple. Paste the original text into the Hash Generator and note the SHA-256 digest. Later — after the text has passed through email, a CMS paste, or a copy between apps — hash it again and compare. If the two digests match, nothing changed. If they differ, an invisible edit crept in: a smart-quote substitution, a stripped line break, or a trailing space.
This is more trustworthy than a visual review precisely because the things that break formatting are often the things you cannot see.
What hashing can't do
Hashing is not encryption. A hash is one-way: you cannot reverse a SHA-256 digest back into the original text. That also means hashing does not hide or protect content — it only lets you detect change. Two more limits are worth stating plainly:
- A raw hash of a password is not safe storage. Passwords need a slow, salted function (bcrypt, scrypt, Argon2), not a bare MD5 or SHA-256.
- Encoding matters. The same visible text hashed as UTF-8 and as UTF-16, or with and without a trailing newline, produces different digests. Compare like with like.
Verifying a file download
The most common real-world use is confirming a download arrived intact. A vendor publishes the SHA-256 of an installer; you compute the checksum of the file you received and compare. A match means the bytes are identical to what the vendor shipped. A mismatch almost always means a corrupted or incomplete download — or, rarely, a tampered file. For local files, use the File Hash & Checksum Verifier, which reads the file in your browser and never uploads it.
Common mistakes to avoid
- Using MD5 or SHA-1 for anything security-related — use SHA-256 instead.
- Confusing hashing with encryption, or expecting to "decode" a hash.
- Comparing hashes generated from different encodings or with stray whitespace.
- Storing bare password hashes instead of using a dedicated password-hashing function.
Used correctly, a hash is one of the cheapest integrity checks available: paste, compare, and you know for certain whether two versions match — no guessing, and nothing leaves your browser.