How to Create MD5 and SHA-256 Hashes: Command Line, Python, and PHP

A hash function reads any amount of input and produces a fixed-length digest. The same input always yields the same digest, a single changed bit changes the output completely, and the transformation runs in one direction only. Those three properties are what make hashing useful for integrity checking, deduplication, and signatures.

Generating a digest is trivial in every language and on every operating system. The parts that trip people up are subtler: which algorithm to use, how the input was encoded before hashing, and how to compare two digests correctly.

Choosing an algorithm

MD5 produces 128 bits, rendered as thirty-two hexadecimal characters. SHA-1 produces 160 bits and forty characters. Any SHA256 hash calculator returns 256 bits as sixty-four characters, and SHA-512 produces 512 bits and 128 characters. The digest length alone tells you which algorithm produced a value.

For anything security-relevant, use SHA-256 or stronger. MD5 and SHA-1 are both broken against collision attacks, meaning an attacker can construct two different inputs with the same digest. They remain acceptable for non-adversarial uses such as cache keys and detecting accidental corruption, where nobody is trying to deceive you.

Hashing text and the encoding question

Hash functions consume bytes, not characters, so a string must be encoded before it can be hashed. This is why the same word can produce different digests in two systems: one encoded it as UTF-8, the other as UTF-16 or a legacy single-byte character set.

Always state the encoding explicitly rather than relying on a platform default. In .NET use Encoding.UTF8.GetBytes() before hashing, and in Python call encode('utf-8') on the string. When two implementations disagree about a digest, encoding is the first thing to check, closely followed by an invisible trailing newline.

Generating from the command line

Linux provides md5sum, sha256sum, and their siblings, which print the digest followed by the filename. macOS ships md5 and shasum -a 256, with different output formatting. Windows offers certutil -hashfile file SHA256, and PowerShell provides Get-FileHash.

Hashing a string from a shell needs care, because echo appends a newline that becomes part of the input. Use printf '%s' "value" | sha256sum to avoid it. This single detail accounts for a large share of the cases where a script and a web tool disagree about the digest of the same text.

Generating in application code

Python's hashlib offers md5(), sha256(), and the rest, with hexdigest() for the familiar hexadecimal form. Java uses MessageDigest.getInstance("SHA-256"), and .NET uses SHA256.HashData(). PHP wraps everything in a single hash() function that takes the algorithm name.

In browsers, the Web Crypto API provides crypto.subtle.digest(), which is what a hash generator online is built on: it is asynchronous and returns a buffer you convert to hexadecimal yourself. Note that it deliberately omits MD5, since the platform does not offer a broken algorithm even for non-security purposes.

Hashing files rather than strings

An MD5 hash a file operation, or the SHA-256 equivalent, is the most dependable form of hashing. For files, the input is the raw byte content, with no encoding decision to make and no newline ambiguity. This is why file checksums are reliable across operating systems: two machines hashing the same bytes always agree.

Large files should be hashed incrementally rather than loaded into memory. Every language provides an update-and-finalise interface for this, feeding the file in chunks. A hash computed in one pass over a stream is identical to one computed over the whole buffer, so there is no downside to streaming.

Hexadecimal, Base64, and comparison

The same digest can be printed in different ways. Hexadecimal is conventional for checksums; Base64 is common in HTTP headers and certificate fingerprints because it is more compact. A SHA-256 digest is sixty-four hexadecimal characters or forty-four Base64 characters, and they represent identical bytes.

When comparing digests in security-sensitive code, use a constant-time comparison function rather than string equality. An ordinary comparison returns as soon as it finds a difference, and that timing difference can leak information. Libraries provide hmac.compare_digest, CryptographicOperations.FixedTimeEquals, and equivalents for exactly this purpose.

What a plain hash is not for

Hashing a password with MD5 or SHA-256, salted or not, is inadequate. These functions are designed to be fast, and speed is precisely what an attacker with a stolen database wants. Password storage needs a deliberately slow algorithm such as bcrypt, scrypt, or Argon2, with a work factor you can raise over time.

A plain hash also proves nothing about origin. Anyone can recompute a digest after modifying a file, so a checksum published beside a download only detects accidental corruption. Proving that a specific party produced the content requires an HMAC with a shared key or a digital signature.

Hash algorithm specifications side by side

Digest size is the quickest way to identify an algorithm from its output alone. The MD5 hash bit length is 128, and the SHA256 hash length is 256 bits, which is where the SHA256 hash character length of sixty-four hexadecimal characters comes from.

The MD5 hash bits count of 128 is fixed regardless of input size, which is the defining property of a hash. Any SHA 256 hash algorithm generator produces 256 bits for the same reason, and a SHA256 hash converter between hexadecimal and Base64 changes only the presentation of those bits.

The MD5 hashing algorithm processes input in 512-bit blocks through four rounds, producing MD5 hash bytes that are then rendered as hexadecimal. The SHA256 hash algorithm follows the same overall shape with a larger state and more rounds. For a SHA 256 hash algorithm example worked bit by bit, or the MD5 hash algorithm steps with example values, the original specifications are the authoritative source, and a SHA256 hash algorithm explained walkthrough adds little for practical use; for practical work, the only property that matters is that both are one-way and fixed-length.

Hash generator commands and code

The table gathers the calls that produce an MD5 hash value or a SHA-256 digest in each environment.

The last two rows matter for HTTP integrity headers and certificate fingerprints, where the digest is carried as Base64 rather than hexadecimal. It is the same digest in a different presentation, so an MD5 hash converter between the two forms is a re-encoding rather than a re-computation.

Salt, keys, and password hashing

Requests for an MD5 generator with salt or a SHA256 generator with salt usually come from password storage, and that is the wrong tool. Salting a fast hash still leaves it fast, which is exactly what an attacker needs. Use a hash password generator bcrypt implementation, or Argon2, where the work factor is tunable.

A SHA256 generator with key means something different: keyed hashing, or HMAC, which proves that whoever produced the digest held the shared secret. Use HMAC-SHA256 for webhook signatures and API authentication. A hash generator password field in a plain digest tool offers neither property, and a SHA256 certificate generator is a different operation again, producing a fingerprint of an existing certificate rather than creating one.

Collisions and why MD5 is broken

An MD5 hash collision is two different inputs with the same digest, and constructing one now takes seconds on ordinary hardware. That is what MD5 hash broken means in practice, and it is why an MD5 collision generator exists as a research tool rather than as a mystery.

The MD5 hash collision probability by chance remains negligible, which is the source of the confusion: accidental collisions are still vanishingly rare, while deliberate ones are trivial. The distinction decides usage. Detecting accidental corruption is fine; anything an adversary can influence needs SHA-256. A SHA256 hash collision has never been produced, and no practical method is known.

Choosing an MD5 hash alternative

For file integrity where nobody is attacking you, MD5 is adequate and fast. For anything else the MD5 hash alternative is SHA-256, or SHA-512 if you are on 64-bit hardware and want more speed. For passwords the alternative is not a hash function at all but a password hashing scheme.

Two historical variants cause confusion. An Apache MD5 generator, sometimes called an MD5 crypt generator, produces the iterated $apr1$ format used by htpasswd, which is not a plain MD5 digest and cannot be compared against one. And what is sometimes labelled an MD5 encryption generator is simply hashing under a misleading name, since MD5 performs no encryption and has no key.

Reproducing a digest that will not match

When two systems disagree about the digest of what should be identical input, work through the causes in order. Check the encoding, then check for a trailing newline, then check whether one side hashed the text form of a value and the other hashed its binary form. Numbers and dates are common offenders, since their string representations vary by locale and formatting.

Line endings deserve their own mention. A file that passed through a Windows checkout with automatic conversion contains carriage returns that a Unix checkout does not, and the two produce entirely different digests despite looking identical in an editor. Hash the raw bytes and compare file sizes first; a difference of exactly the line count is a conclusive signal.

References: NIST FIPS 180-4 specifies the SHA family, and the OWASP Password Storage Cheat Sheet covers algorithm choice for credentials.