Cryptographic hash functions are fundamental building blocks of modern computer security, database indexing, digital signatures, blockchain ledgers, and file verification.

Unlike encryption (which is designed to be decrypted with a secret key), hashing is a one-way mathematical transformation that maps arbitrarily sized input data into a fixed-length string of bytes.

This guide explains how hashing algorithms work, compares MD5, SHA-1, and SHA-256, and demonstrates how to verify file checksums online and in terminal commands.

Key Characteristics of Cryptographic Hash Functions

Every secure cryptographic hash function exhibits four properties:

  1. Deterministic Output: The exact same input always produces the exact same hash output.
  2. Fixed Length Output: Regardless of whether the input is 1 word or a 50GB file, SHA-256 always outputs a 256-bit (64 hex character) hash.
  3. One-Way (Pre-image Resistance): It is computationally infeasible to reconstruct the original input from a hash digest.
  4. Avalanche Effect: Changing a single bit in the input radically alters the resulting hash output string.

Comparison: MD5 vs SHA-1 vs SHA-256

| Algorithm | Digest Size (Bits) | Output Length (Hex) | Security Status | Primary Use Case | | :--- | :--- | :--- | :--- | :--- | | MD5 | 128 bits | 32 characters | Broken (Collisions) | Legacy non-crypto checksums, deduplication | | SHA-1 | 160 bits | 40 characters | Deprecated | Legacy Git commit hashes, legacy SSL | | SHA-256 | 256 bits | 64 characters | Highly Secure | TLS/SSL certificates, Bitcoin, file verification |

How to Verify File Integrity Using Checksums

When downloading ISO installation images, software releases, or zip archives, developers publish a SHA-256 checksum string alongside the file.

Checking SHA-256 in Terminal Commands

Windows PowerShell:

Get-FileHash -Algorithm SHA256 path/to/software.iso

macOS / Linux Terminal:

shasum -a 256 path/to/software.iso

If the terminal output matches the published publisher string character-for-character, the download is 100% genuine and uncorrupted.

Online Hash & Checksum Calculator

Generate MD5, SHA-1, and SHA-256 hash digests directly in your browser using the free ToolzStack Hash Generator and SHA-256 Generator.