Cryptographic Hashes Explained: MD5, SHA-256, SHA-512 & HMAC Signatures

Published 2026-08-03 | Author: Sarah Connor | Category: dev-experience

A deep dive into one-way cryptographic hash functions, digest lengths, avalanche effects, and HMAC API request signing.

## What Is a Cryptographic Hash Function? A cryptographic hash function accepts an arbitrary string or binary payload as input and transforms it into a fixed-length hexadecimal digest. Hash functions are strictly **one-way operations**—meaning it is computationally impossible to reverse a digest back into its original input payload. --- ## 1. Algorithm Comparison Matrix | Algorithm | Output Size | Collision Resistance | Status / Recommended Use | | :--- | :--- | :--- | :--- | | **MD5** | 128 bits (32 hex chars) | Weak (Broken) | Checksums, fast lookup tables | | **SHA-1** | 160 bits (40 hex chars) | Weak (Deprecated) | Legacy Git commit hashes | | **SHA-256** | 256 bits (64 hex chars) | Extremely High | Modern Web Crypto, API Signatures, Blockchain | | **SHA-512** | 512 bits (128 hex chars) | Maximum | High-security financial payloads | --- ## 2. The Avalanche Effect & HMAC Authentication A core requirement of cryptographic hashing is the **Avalanche Effect**: changing a single character in the input string dramatically alters every character in the generated output hash. **HMAC (Hash-based Message Authentication Code)** combines a secret key with the message payload to guarantee both data integrity and sender authenticity across REST endpoints.