Hash Function Explorer — TechKnowSurge

About this interactive

What you're seeing: three panels driven by one idea. The top panel hashes whatever you type with MD5, SHA-1, SHA-256 and SHA-3-256 at the same time; the bottom-left panel takes that same string, changes exactly one character, and counts how many of the output bits moved; the bottom-right panel compares a candidate string against a target digest and says match or no match. Every value is genuinely computed from your bytes — SHA-1 and SHA-256 by the browser's own cryptography, MD5 and SHA-3 by implementations checked against the published test vectors — so the hash of "abc" here is the hash of "abc" anywhere. Why it matters: three properties of a hash function do all the work in practice, and each panel isolates one of them. Fixed output length, whatever the input, is why a hash is a fingerprint and also why collisions must exist. The avalanche effect — one character in, about half the bits out — is why an attacker cannot get closer by guessing closer, and why any change to a file is obvious rather than subtle. And one-way comparison is why a password database can be stolen without immediately handing over the passwords, and why the site can never email you the one you forgot. How to use it: type your name in panel 01 and read down the column of lengths before you read any of the values. Then press "Flip one character of A" in panel 02 a few times and watch the percentage refuse to drop — try it on each of the four algorithms, since the property is a design goal rather than an accident of one of them. Finally, in panel 03, press "Load a stolen hash" and try to work out the plaintext from the hint. That is an offline guessing attack in miniature, and the reason a real one succeeds is not that the hash was weak but that the password was.

How to use this tool

A hash function turns any input into a fixed-length fingerprint that cannot be run backwards. Three panels, one property each. Every digest here is really computed — SHA-1 and SHA-256 by your browser's own cryptography, MD5 and SHA-3-256 by implementations in the page verified against the published test vectors — so these values match any other correct tool, digit for digit.

Panel 01 — one input, four digests. Type anything; all four hashes update as you type. Read the lengths before you read the values: MD5 always returns 32 hex digits, SHA-1 always 40, SHA-256 and SHA-3-256 always 64, whether the input is one character or a paragraph — and the empty input still produces a full digest. MD5 and SHA-1 are marked in orange because both are cryptographically broken; they remain here because you will keep meeting them.

Panel 02 — avalanche effect. Press Flip one character of A. One character changes and roughly half of the output bits change with it, which the panel counts rather than asserts. Try it on all four algorithms and the figure stays near 50%. Nothing about the digest hints at how similar the two inputs were, so an attacker cannot get "warmer" by guessing closer — which is the property the third panel depends on.

Panel 03 — does this string match this hash? Enter a candidate string and a target digest and press Check. This is exactly what a login server does: it hashes what you typed and compares. It never reverses anything, which is why a site cannot email you your forgotten password. Press Load a stolen hash for a target with a hint, and try to work out the plaintext — that is an offline guessing attack, the thing that happens after every credential breach. Press Use panel 01's hash to test a string you chose yourself.

Nothing is graded, nothing is stored, and nothing you type leaves this frame — all four algorithms run inside this page.

What you'll learn

Compute the MD5, SHA-1, SHA-256 and SHA-3-256 digest of an arbitrary input and compare their fixed output lengths
Demonstrate the avalanche effect by changing one character of an input and measuring the proportion of output bits that change
Verify a candidate string against a stored digest the way a password check does, and explain why that comparison runs in one direction only

Aligned to

CompTIA Security+

1.4 Explain the importance of using appropriate cryptographic solutions.

ISC2 CISSP

3.6 Select and determine cryptographic solutions

3.7 Understand methods of cryptanalytic attacks

NIST NICE

S0622 Skill in implementing one-way hash functions

NIST 800-53

SI-7 Software, Firmware, and Information Integrity.

IA-5 Authenticator Management.

EC-Council CEH

9.1 Cryptography

Key terms

Hash Function: A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
One-Way Function: A mathematical operation used in hashing that is computationally infeasible to reverse, meaning the original input cannot be derived from the output.
Avalanche Effect: A property of cryptographic hash functions where a small change in the input produces a drastically different output hash value.
Message Digest 5: Message Digest 5 is a widely used cryptographic hash function producing a 128-bit digest; MD5 is considered cryptographically broken due to collision vulnerabilities and must not be used for security-critical purposes such as digital signatures or certificate validation.
Secure Hash Algorithm: Secure Hash Algorithm is a family of cryptographic hash functions standardized by NIST, including SHA-1 (deprecated for most uses), SHA-256, and SHA-3, used for data integrity verification, digital signatures, and certificate validation.
Hashing Collision: An event where two different inputs produce the same hash output; a good hashing algorithm minimizes how often this occurs.
Data Integrity: The assurance that data has not been altered or corrupted during storage or transmission.
Salting: The practice of appending a unique random value to a password before hashing to prevent rainbow table lookups and ensure identical passwords produce different hash outputs.
Rainbow Table: A precomputed lookup table used to reverse cryptographic hash functions, allowing attackers to recover plaintext passwords from stolen hashed credentials. Rainbow table attacks are defeated by adding a unique salt to each password before hashing.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.

Topics

Hashing Cryptography Avalanche Effect Integrity Password Security Md5 Sha 256 Sha 3

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →