What a hash function guarantees
A cryptographic hash maps input of any length to a fixed-size digest. Three properties make it useful: the same input always yields the same digest, changing a single bit changes roughly half the output bits, and there is no practical way to work backwards from a digest to the input.
That last property is why hashing is not encryption. There is no key and no decryption step — the operation is one-way by design. If you need to recover the original data later, hashing is the wrong tool.
Which algorithm to use
SHA-256 is the sensible default for almost everything: fast, universally supported, no known practical weaknesses. SHA-512 produces a longer digest and is often *faster* on 64-bit hardware because it operates on 64-bit words.
SHA-1 is broken for security purposes. A practical collision was demonstrated in 2017 (the SHAttered attack), and browsers and certificate authorities have rejected it for years. It survives only in legacy contexts such as Git object identifiers, where collision resistance is not the property being relied on. It is offered here for compatibility, not as a recommendation.
Never hash passwords with SHA
SHA functions are engineered to be fast, which is exactly the wrong property for password storage. Modern GPUs compute billions of SHA-256 hashes per second, so a leaked table of SHA-256 password hashes falls to a dictionary attack almost immediately — salt or no salt.
Password storage needs a deliberately slow, memory-hard function with a tunable cost factor: Argon2id, scrypt or bcrypt. These are designed so that raising the cost parameter makes attacks proportionally more expensive while barely affecting a legitimate login.
Where hashes show up day to day
Integrity verification. A project publishes the SHA-256 of a release; you hash your download and compare. If the digests match, the file was not altered in transit.
Subresource Integrity. A <script integrity="sha384-..."> attribute tells the browser to refuse a CDN script whose digest does not match, protecting you if the CDN is compromised.
Deduplication and caching. Content-addressed systems — Git, Docker layers, most build caches — name objects by their hash, so identical content is stored exactly once.