What Is Password Hashing?
Hashing converts a password into a fixed-length string of characters. Unlike encryption, hashing is one-way — you can't reverse a hash to get the original password. Instead, to verify a password, you hash the input and compare it to the stored hash.
Common Hash Algorithms
- MD5: Fast, 32-char hex. Not secure for passwords — easily cracked with rainbow tables.
- SHA-1: 40-char hex. Deprecated for security use.
- SHA-256: 64-char hex. Secure for file integrity, but too fast for password hashing.
- bcrypt: Slow by design. Includes salt automatically. The gold standard for password hashing.
- Argon2: Winner of the Password Hashing Competition. Most secure.
Why "Fast" Is Bad for Password Hashing
MD5 can hash 10 billion passwords per second on modern GPU hardware. bcrypt intentionally takes 100ms per hash. For a user logging in, 100ms is imperceptible. For an attacker trying to crack by brute force, it reduces attempts from 10 billion/sec to 10/sec.
Generate Hashes Online
Use Password Hash Generator to generate MD5, SHA-1, SHA-256, SHA-512, and bcrypt hashes for testing and development purposes.