What a hash function does
A hash function maps input of any size to a fixed-length fingerprint. The same input always produces the same output; changing a single character produces a completely different result. It cannot be run backwards, which is what makes it useful for verifying that something has not changed without storing the thing itself.
Which algorithm to use
- MD5 (128-bit) — broken since 2004. Collisions can be produced in seconds. Acceptable only as a checksum against accidental corruption.
- SHA-1 (160-bit) — broken in practice since 2017. Being phased out everywhere; do not start new work with it.
- SHA-256 (256-bit) — the current default for signatures, certificates and content addressing. No known weaknesses.
- SHA-384 / SHA-512 — same family, longer output. SHA-512 is often faster than SHA-256 on 64-bit hardware.
Hashing is not encryption, and not password storage
Encryption is reversible with a key; hashing is not reversible at all. And while passwords should be hashed rather than stored in plain text, a general-purpose hash is the wrong tool: its speed is a liability. Password hashing needs an algorithm that is deliberately expensive to compute and salted per user.
To generate a strong password in the first place, use the password generator. For reversible encoding rather than hashing, see the Base64 encoder.