Hashing Is Not Encryption: A Practical Guide to SHA-256, MD5, and When to Use Each

A hash function takes input of any size and produces output of a fixed size. The same input always produces the same output. You cannot reverse the output back to the input. That is the entire concept, and getting those three properties straight will save you from a surprising number of mistakes. I have seen developers confuse hashing with encryption, use MD5 for passwords in 2024, and store unsalted SHA-256 hashes thinking they were secure. Each of these is a different category of wrong. Let me break down what hashing actually does and when each algorithm is appropriate. How hash functions work A cryptographic hash function has four key properties. Deterministic: the same input always gives the same output. Fast to compute: you can hash gigabytes of data in seconds. Irreversible: given a hash output, you cannot compute the input (this is called preimage resistance). Collision resistant: it is computationally infeasible to find two different inputs that produce the same output. The out