PlayInfoBox

Home /Text /SHA Hashes Explained: What SHA-1, 256, 384, and 512 Actually Do

SHA Hashes Explained: What SHA-1, 256, 384, and 512 Actually Do

A hash function turns any input into a fixed-length string of characters, and understanding what that guarantees β€” and does not β€” explains most of what hashes are used for.

Hashing is one-way by design

Computing a hash from an input is fast and easy, but reversing a hash back into its original input is designed to be computationally infeasible. That is what separates hashing from encryption, which is meant to be reversible with the right key.

Output length never changes

SHA-256 always produces a 256-bit (64 hex character) output, whether you hash one character or an entire book. The fixed length is part of what makes hashes useful as compact fingerprints of arbitrary-sized data.

The same input always produces the same hash

Hashing the identical input twice, on any device, always yields the identical output β€” the property that makes hashes useful for verifying that a file was not altered or corrupted.

A tiny input change produces a completely different hash

Changing a single character in the input scrambles the entire output hash unrecognizably rather than changing just part of it, which makes hashes useless for detecting "how similar" two inputs are, only whether they are identical.

SHA-1 is broken for security purposes

Researchers have demonstrated practical collision attacks against SHA-1 β€” finding two different inputs with the same hash β€” so it is no longer considered safe for security-sensitive uses like certificates, though it still appears in legacy systems or non-security contexts like Git's internal object IDs.

SHA-256, SHA-384, and SHA-512 mainly differ in output length

All three belong to the same SHA-2 family and are currently considered secure. The number refers to output length in bits, with longer outputs offering a larger theoretical security margin at the cost of slightly more computation.

Hashing is not encryption

A common point of confusion is treating a hash as a scrambled but recoverable form of the original data. It is not β€” there is no key or process that turns a hash back into its input, which is exactly why hashes are used to verify data rather than to protect data you need to get back later.

Why plain hashing is not enough for passwords

Storing a raw SHA-256 hash of a password is still vulnerable to precomputed lookup tables and brute-force attacks, since the same password always produces the same hash. Real password storage systems add a random "salt" per user and use algorithms specifically designed to be slow, like bcrypt or Argon2, which a general-purpose fast hash like SHA-256 is not.

Frequently Asked Questions

If two files produce the same hash, are they definitely identical?

For SHA-256, SHA-384, and SHA-512, yes for all practical purposes β€” a coincidental collision is astronomically unlikely with current algorithms. For SHA-1, deliberate collisions have been demonstrated, so it should not be relied on for security-critical integrity checks.

Can I use a hash generator to check if a downloaded file was corrupted?

Yes β€” this is one of the most common legitimate uses. Compare the hash the publisher provides against the hash you generate from your downloaded copy; if they match, the file was not altered or corrupted in transit.