Compare hash algorithm output length and collision security

It accepts common spellings and punctuation variants, returns one canonical name, and rejects unknown algorithms explicitly. Use it to review configuration, explain a migration, or prevent an obsolete digest from quietly entering a new system. The concise JSON result is ready for policy automation and technical documentation.

What the comparison tells you

A hash function maps an input of arbitrary size to a fixed-size digest. The output length is therefore a basic property of the named algorithm: SHA-256 produces 256 bits, while SHA-512 produces 512 bits. This tool reports that size without hashing any data. It also reports whether the algorithm is currently considered cryptographically broken for collision resistance. A collision occurs when two different inputs produce the same digest. When practical collision attacks are known, an attacker may be able to construct two documents or files with an identical hash, so the digest should not be trusted as proof that content is unique or unchanged. The result uses a direct boolean to make policy checks simple. A true value is a clear migration signal; a false value means no practical break is represented by this capability, not that every possible use of the algorithm is automatically secure.

Names, aliases, and deterministic results

Algorithm names appear in many styles across configuration files and documentation. SHA-256 may be written as sha256, SHA_256, or SHA-256, and all of those identify the same function. The comparator normalizes capitalization and common separators before looking up the algorithm, then returns a stable canonical spelling. It also recognizes the conventional short names BLAKE2b and BLAKE2s as their standard 512-bit and 256-bit variants. The supported set is deliberately finite. An unfamiliar label produces an invalid-input error instead of a speculative answer, because names can hide important differences in digest size or construction. The lookup is deterministic, contains no network access, and does not depend on the current clock. That makes it suitable for build checks and repeatable documentation generation: identical input always yields identical JSON, and a misspelled or unsupported name fails visibly rather than silently selecting a nearby algorithm.

Use collision status in the right context

Collision resistance is only one security property. A result of false for collision_resistance_broken does not endorse an algorithm for password storage, message authentication, digital signatures, or every protocol. Passwords need a dedicated password-hashing construction with salt and an adjustable work factor; a fast general-purpose hash is unsuitable even when its collision resistance remains intact. Authentication usually requires a keyed construction such as HMAC rather than a bare digest. Protocol requirements, truncation, implementation quality, and preimage resistance can also change the security decision. Treat this result as a precise answer to a narrow question: whether the named algorithm has a recognized practical collision break in this capability's maintained classification. Use it to flag MD5, SHA-1, and other broken choices, then apply the standards and threat model for the system you are reviewing. Recheck security guidance during migrations because cryptanalytic conclusions and approved-algorithm policies can evolve independently.