Hashing & Checksums Cheat Sheet
Quick reference for hash functions and checksums: MD5, SHA-1, SHA-2, SHA-3, HMAC, CRC32, and when to use each.
Hashing maps arbitrary data to a fixed-size digest. Purpose matters: fast hashes are for integrity/checksums, cryptographic hashes for tamper evidence, and deliberately slow hashes (bcrypt, argon2, scrypt) for passwords.
Common Algorithms
| Algorithm | Digest size | Use for | Avoid for |
|---|---|---|---|
MD5 | 128-bit | Legacy checksums, duplicate detection | Security (collisions) |
SHA-1 | 160-bit | Legacy integrity checks | Security (collision attack) |
SHA-256 | 256-bit | Integrity, signatures, file verification | Direct password storage |
SHA-512 | 512-bit | Integrity, larger digest | Direct password storage |
SHA-3 | 224–512-bit | Newer designs, hardware-friendly | — |
blake2b/3 | up to 512-bit | Fast hashing, keyed mode | — |
CRC32 | 32-bit | Error detection, archive checksums | Any adversarial integrity |
bcrypt / argon2 / scrypt | variable | Password hashing only | General hashing |
CLI & Code
# SHA-256 of a file
sha256sum file.zip
# Verify with a checksum file
sha256sum -c checksums.txt
# Generic
openssl dgst -sha256 -out file.sha256 file.zip
import hashlib
data = b"hello"
hashlib.sha256(data).hexdigest() # 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
hashlib.md5(data).hexdigest() # 5d41402abc4b2a76b9719d911017c592
hashlib.sha3_256(data).hexdigest()
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode("hello"));
const hex = [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
HMAC
HMAC adds a secret key to a hash, proving authenticity as well as integrity. The receiver must share the key.
openssl dgst -sha256 -hmac "secret" -binary file.txt | base64
import hmac, hashlib
hmac.new(b"secret", b"message", hashlib.sha256).hexdigest()
Password Hashing
Passwords must use slow, salt-included algorithms — never plain MD5/SHA. Each password gets a random salt; the output embeds the salt.
import bcrypt
hashed = bcrypt.hashpw(b"secret123", bcrypt.gensalt())
bcrypt.checkpw(b"secret123", hashed) # True
// argon2 (node)
import { hash, verify } from "argon2";
const hashStr = await hash("secret123");
await verify(hashStr, "secret123");
Common Pitfalls
[!WARNING] MD5 and SHA-1 are cryptographically broken — attackers can craft collisions. Do not use them for signatures or password storage.
[!TIP] Even SHA-256 is the wrong choice for passwords without a salt and work factor; your password hashing should be bcrypt, argon2id, or scrypt only.