A hash is a fingerprint, not a copy
A hash function takes any input — a word, a sentence, a whole file — and produces a fixed-length string of characters called a hash or digest. The same input always produces the same hash, and the output is always the same length, no matter how big the input was. Change one letter of the input and the hash changes completely, which is what makes it useful as a fingerprint.
SHA-256, the most widely used hash function, always produces 64 hexadecimal characters — the digits 0 to 9 and the letters a to f. The hash of “Hello Daily Tools” is a specific 64-character string, and any other text gives a different one. The hash tells you nothing about the original text by itself, just as a fingerprint tells you nothing about a person’s face, but it identifies the data it came from.
One way only: you cannot reverse a hash
Hashing is a one-way process. Given a hash, there is no practical way to work backwards to the original text, because the function deliberately throws information away as it mixes the data. The only way to “reverse” a hash is to guess the input, hash the guess, and see if it matches — which is why short, common passwords are a problem, as we explain below.
This is different from encryption. Encryption scrambles data with a key so that it can be unscrambled later with the same key. Hashing has no key and no unscrambling step. That is why hashes are used where you need to check something without storing the original — for example, checking a password without keeping the password itself.
How websites use hashes for passwords
When you create an account, a well-run website does not store your password. It stores a hash of your password, usually with extra steps called salting and slow hashing that make guessing much harder. When you log in, the site hashes what you typed and compares the two hashes. If they match, you are in, and the site never needed to keep your actual password.
That is also why a data breach at one site can still hurt you elsewhere. If your password was short or common, attackers can guess it, hash their guesses, and compare them with the stolen hashes. A long, unique password is much harder to guess this way, which is why password advice always comes back to length and uniqueness, not cleverness.
Checking a download with a hash
The most practical everyday use of a hash generator is checking a file you downloaded. Software publishers often publish the SHA-256 hash of a file next to the download link. After downloading, you hash the file yourself and compare the two strings. If they match exactly, the file arrived complete and unaltered. If they differ, something changed — the download was corrupted, or the file was replaced.
This only works if you get the published hash from a trustworthy source, such as the publisher’s own website, and not from the same place you got a suspicious file. A hash proves the file matches the published fingerprint; it does not prove the publisher is honest. It is a check on the journey, not on the source.
What hashes cannot do
A hash cannot prove who created a file, because anyone can hash anything. It cannot keep a secret, because the same input always gives the same hash — if the input is guessable, the hash is guessable too. And it cannot replace a backup or a signature: a hash detects changes, but it cannot restore the original or prove that a particular person approved it.
You may also hear about “collisions”, where two different inputs produce the same hash. For SHA-256, that is so unlikely in practice that it is not a realistic concern for everyday use. Older hash functions such as MD5 do have known collision problems, which is why SHA-256 is the standard choice today for new work.
Try it yourself
Use the free Hash Generator to hash any text with SHA-256 and SHA-512 in your browser. Try changing one letter of your text and watch the whole hash change — that is the avalanche effect in action.
Try the related tools
Try the Hash Generator on Daily Tools. Try the Password Generator on Daily Tools. Try the UUID Generator on Daily Tools.
Frequently asked questions
What is SHA-256?
SHA-256 is a widely used hash function that turns any input into a fixed 64-character fingerprint. The same input always gives the same hash, and changing one letter changes the whole result.
Can a hash be reversed to get the original text?
No, hashing is one-way. The only way to find the input is to guess it, hash the guess, and compare. That is why short, common passwords are unsafe even when stored as hashes.
How do I use a hash to check a download?
Hash the downloaded file yourself and compare the result with the hash published by the software maker. If the two strings match exactly, the file arrived complete and unaltered.