What is a cryptographic hash, and which SHA should you use?
A cryptographic hash function compresses any input into a fixed-size digest that acts like a fingerprint: identical inputs produce identical digests, and even a one-character change produces a completely different result.
Properties of a good hash
Hash functions are deterministic, one-way, collision-resistant, and avalanche-prone. You cannot reconstruct the input from the digest, finding two inputs with the same digest is practically impossible for a healthy function, and small input changes alter most output bits.
These properties make hashes ideal for file checksums, deduplication, signatures, and integrity checks. They are not encryption—there is no key to decrypt with.
SHA-1 vs SHA-256 vs SHA-384 vs SHA-512
Digest size in bits drives both safety and length.
| Algorithm | Digest size | Status | Best fit |
|---|---|---|---|
| SHA-1 | 160 bits (40 hex) | Broken for collision resistance; legacy only | Verifying old systems that mandate it, such as legacy Git object checks |
| SHA-256 | 256 bits (64 hex) | Current default | Checksums, certificates, blockchains, general integrity work |
| SHA-384 | 384 bits (96 hex) | Current | TLS suites and protocols that specify it explicitly |
| SHA-512 | 512 bits (128 hex) | Current, fastest on 64-bit platforms | High-security requirements and long-lived integrity guarantees |
Choosing an algorithm today
Use SHA-256
It is widely supported, fast enough for most workloads, and the de facto standard for integrity verification.
Consider SHA-512
On modern 64-bit hardware SHA-512 is often faster than SHA-256 while offering a larger margin of security.
Never store plain SHA digests
Password hashing needs deliberately slow, salted algorithms such as Argon2, bcrypt, or scrypt—not raw SHA output.