Question 1

What is a cryptographic hash function?

Accepted Answer

A one-way function that turns any data into a fixed-size string. Same input always gives the same hash. Can't reverse it. Used for checking file integrity, storing passwords (with proper algorithms), and verifying data hasn't changed.

Question 2

Which hash algorithm should I use?

Accepted Answer

File verification: SHA-256. API signatures: HMAC-SHA256. Passwords: bcrypt or Argon2, NOT plain hashes. Avoid MD5 and SHA-1 for security — they're broken. Use them only for non-security checksums if you must.

Question 3

What's the difference between MD5, SHA-1, SHA-256, and SHA-3?

Accepted Answer

MD5: Broken. Don't use for security. SHA-1: Deprecated. Google broke it in 2017. SHA-256/512: Current standard. Secure and widely used. SHA-3: Newest standard. Different design from SHA-2. Also secure. Use SHA-256 for most things.

Question 4

How do I verify file integrity with hashes?

Accepted Answer

Hash your file. Compare it to the hash from the download page. If they match, your file is good. If they don't match, the file is corrupted or tampered with. Don't use it.

Question 5

What is HMAC and when should I use it?

Accepted Answer

HMAC adds a secret key to hashing. Proves the message came from someone with the key. Use it for API signatures (AWS, Stripe), webhook verification, session tokens. HMAC-SHA256 is the standard.

Question 6

How should I hash passwords securely?

Accepted Answer

Don't use MD5, SHA-256, or any plain hash for passwords. Use bcrypt, Argon2, or scrypt. They're designed to be slow, which stops brute-force attacks. Add a random salt. High iteration count (100,000+). The Password tab here is educational only.

Question 7

What are the different output formats?

Accepted Answer

Hex: Standard format. Most tools expect this. Base64: Shorter, good for JSON or databases. Base64-URL: Safe for URLs and query params. Binary: For debugging only.

Question 8

Why does the tool warn about MD5 and SHA-1?

Accepted Answer

They have known collision attacks. MD5 has been broken since 2004. SHA-1 since 2017. Use them only for non-security checksums. The tool marks them red (broken) or yellow (deprecated) so you know the risk.

Question 9

Can I hash large files?

Accepted Answer

Yes. The tool processes files in 1MB chunks with a progress bar. Works with multi-gigabyte files without eating all your RAM. Speed depends on your device. SHA-256 is faster than SHA-512.

Question 10

What are the visual identicons?

Accepted Answer

Unique patterns generated from hash values. Same hash = same pattern. Makes it easier to spot changes visually, like GitHub avatars for hashes.

Cryptographic Hash & Encoding Toolkit

How to Use

Frequently Asked Questions

Related Tools

Base64 Encoder/Decoder

URL Encoder/Decoder & Toolkit

JWT Decoder