Blog
Use SHA-256. That is the answer for 95% of use cases. But here is when the other options make sense and why.
| SHA-1 | SHA-256 | SHA-512 | |
|---|---|---|---|
| Output size | 160 bits (40 hex) | 256 bits (64 hex) | 512 bits (128 hex) |
| Security | Broken (collisions found) | Secure | Secure |
| Speed | Fastest | Fast | Slightly slower on 32-bit, faster on 64-bit |
| Use in 2026 | Legacy only | Standard choice | High-security applications |
| Bitcoin | No | Yes (mining, addresses) | No |
| TLS certificates | Deprecated | Standard | Supported |
| Git | Yes (transitioning out) | Planned replacement | No |
SHA-1 was the standard from 1995 to roughly 2015. In 2017, Google and CWI Amsterdam produced the first SHA-1 collision (SHAttered), proving that two different inputs could produce the same hash. Since then:
Still used in non-security contexts where collision resistance is not critical.
SHA-256 has no known practical attacks. It powers Bitcoin, TLS certificates, code signing, and countless verification systems. When someone says "hash it" without specifying an algorithm, they usually mean SHA-256.
Good for: checksums, digital signatures, blockchain, HMAC authentication, data integrity, deduplication.
SHA-512 is actually faster than SHA-256 on 64-bit processors because it operates on 64-bit words natively. The larger output (512 bits) provides a bigger security margin but is overkill for most applications.
Good for: high-security environments, when you need a larger hash output, or when running on 64-bit hardware where it may actually be faster.
The Hash Generator lets you compute SHA-1, SHA-256, and SHA-512 for any text. Compare the outputs side by side.
Generate SHA-1, SHA-256, or SHA-512 hashes instantly.
Open Hash Generator →MD5 is completely broken. Collisions can be generated in seconds on a modern laptop. Do not use it for security. It still appears as a legacy checksum format (some download pages still list MD5 hashes) but should be replaced with SHA-256 wherever possible.
None of the SHA algorithms are appropriate for password hashing. They are too fast. A GPU can compute billions of SHA-256 hashes per second, making brute-force password cracking trivial. Use purpose-built password algorithms:
These algorithms are intentionally slow (hundreds of milliseconds per hash) to make brute-force attacks impractical.
Related: Password Generator for creating strong passwords, Base64 Encoder for encoding hash output, JWT Decoder which uses HMAC-SHA-256 for signatures.