हैश जेनरेटर

SHA-1 produces a 160-bit (40 hex character) hash. It was the security standard through the early 2010s but is now considered cryptographically weak — practical collision attacks were demonstrated in 2017. Do not use it for security applications. SHA-256 produces a 256-bit (64 hex character) hash, part of the SHA-2 family. It is the current standard for TLS certificates, code signing, cryptocurrency, and most security applications. SHA-512 produces a 512-bit (128 hex character) hash, also SHA-2. It is faster than SHA-256 on 64-bit processors and provides a larger security margin.

No. Cryptographic hash functions are designed to be one-way — there is no mathematical inverse. The only way to "crack" a hash is exhaustive search: try inputs until one produces the same hash. For short or common inputs (short passwords, dictionary words), precomputed rainbow tables make this fast. For long random inputs, it is computationally infeasible with current or foreseeable hardware. This is why hashing is appropriate for password storage — even if the database is stolen, the passwords cannot be recovered from the hashes (assuming proper salting).

A collision occurs when two different inputs produce the same hash. Since hash functions map infinite inputs to a finite output space, collisions must theoretically exist. The security property is collision resistance — making it computationally infeasible to find any two inputs with the same hash. SHA-1's collision resistance is broken. SHA-256 and SHA-512 are currently considered collision resistant. A collision in SHA-256 has not been found; estimates suggest it would require computational resources exceeding the world's current computing capacity.

The avalanche effect is the property that a small change in input produces a drastically different output. In SHA-256, changing a single character in the input changes approximately half of all 256 output bits. This is a deliberately designed security property — it prevents any relationship between similar inputs from being visible in their hashes, which would reveal information about the input. You can observe this directly: hash "Hello" and "hello" and compare the completely different outputs despite a one-character difference.

Hash functions are one-way by design — you cannot decrypt a hash to recover the original data. Encryption is two-way: data encrypted with a key can be decrypted with the same or related key. They solve different problems: hashing proves data integrity and stores passwords securely (you verify by re-hashing and comparing, not decrypting). Encryption provides confidentiality (the data itself must be recoverable). Using hashing for data you need to retrieve later is an architectural mistake — use AES encryption instead.

The answer depends entirely on the input entropy. A 6-character lowercase password (308 million possibilities) can be brute-forced against SHA-256 in seconds on modern hardware. A dictionary word plus a number takes minutes. A random 16-character password (from our Password Generator) has more possible inputs than there are atoms in the observable universe — effectively impossible to brute-force. This is why password hashing should use bcrypt, Argon2, or PBKDF2 — these functions are deliberately slow, making brute-force attacks take thousands of years even for relatively short passwords.

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a message authentication code. Regular SHA hashing: hash(message) — anyone can compute it. HMAC: hash(secret + message) — only parties with the secret can compute or verify it. HMAC-SHA256 is used to verify webhook authenticity (Stripe, GitHub), sign API requests (AWS Signature Version 4), and authenticate data in session tokens. The secret key prevents an attacker from forging a valid HMAC even if they can see all messages and their MACs.