Hashing 101: Checksums, HMACs & Best Practices
Learn when to use SHA-256 vs MD5, how HMAC adds authenticity, and tips for comparing digests.
What is a hash?
A hash maps data to a fixed-size digest (e.g., 256 bits). Small changes in input cause large, unpredictable changes in the output (“avalanche effect”).
HMAC vs plain hash
HMAC (Hash-based Message Authentication Code) mixes a secret key with the message to provide integrity and authenticity. Use HMAC-SHA-256 or HMAC-SHA-512 for API tokens or webhooks.
Which algorithm should I pick?
- SHA-256 / SHA-512: modern, widely supported; good for checksums/HMACs.
- SHA-3-256/512: alternative standardized family; useful if required by a spec.
- MD5 / SHA-1: collision-broken; OK for non-security checks like file integrity where tampering is not a concern.
Comparing digests safely
Normalize encodings (hex vs base64), case, and whitespace. For programmatic checks, prefer constant-time comparison when secrets are involved.
FAQ
Is hashing encryption?
No. Hashing is one-way; encryption is reversible with a key.
Can I reverse a hash?
No — hashes are not designed to be reversed.
Why do results differ across tools?
Different encodings (hex/base64), newline handling, Unicode normalization, or salts/HMAC options can change the output. Make sure settings match.