Hash Properties Calculator

No -- every algorithm here always produces the same fixed-length output regardless of input length: SHA-256 always outputs 256 bits whether you hash one character or ten thousand. Input Length in this calculator does not feed into any of the security metrics shown; hash strength depends entirely on which ALGORITHM you select, not on how long the text being hashed is.

Both algorithms still technically run and produce output, but their core security property -- that finding two different inputs producing the same hash (a "collision") should be computationally infeasible -- has been broken in practice. MD5 collisions can be generated in seconds on ordinary hardware, and a real SHA-1 collision was demonstrated publicly in 2017, which is why both are marked "Do not use" or "Deprecated" in the results here.

They're recommended for different jobs. SHA-256 is fast by design, which makes it good for file integrity checks and general-purpose hashing but a poor fit for passwords, since speed is exactly what helps an attacker brute-force a stolen password database. bcrypt is deliberately slow, with a tunable cost factor that can be increased over time as hardware improves, which is why it's the recommended choice specifically for password storage rather than general hashing.

Because the number of possible hash values grows exponentially, not linearly, with output size -- an n-bit hash has 2^n possible outputs. Going from a 128-bit hash to a 256-bit hash doesn't double the search space, it multiplies it by 2^128, an astronomically larger number. To be clear, even MD5's own 128-bit preimage search space is already far beyond brute-force reach -- this calculator estimates roughly 10^21 years at 10 billion hashes/sec, itself vastly longer than the age of the universe, well before the estimate crosses into the "longer than the age of the universe" bucket reserved for the larger algorithms. So MD5's real-world weakness isn't that it can be brute-forced for preimages; it's that its COLLISION resistance is broken. Finding two different inputs that hash to the same MD5 value takes only around 2^18 to 2^64 operations depending on the attack -- practical in seconds to hours on ordinary hardware -- which is what the Collision Resistance figure and the earlier FAQ on MD5/SHA-1 are actually describing.