Hashing explainedOne-way functions, integrity and password storage

What a hash function does

A cryptographic hash function takes an input of any size and produces a fixed-size output, the digest, with these properties:

• Deterministic: the same input always gives the same digest.
• One-way: you cannot compute the input from the digest.
• Avalanche: changing one bit of input changes about half the output bits.
• Collision-resistant: it should be infeasible to find two inputs with the same digest.

SHA-256("hello")  = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hellp")  = 7f8c9a...   (completely different)

Hashing is not encryption

This is the most common confusion. Encryption is reversible with a key: ciphertext decrypts back to plaintext. Hashing has no key and cannot be reversed. You do not "decrypt a hash". They solve different problems: encryption keeps data secret; hashing verifies that data has not changed and lets a system check a password without storing it.

Note that base64 is neither: it is an encoding, fully reversible with no key, used to represent binary as text. A base64 string is not protected at all; the Base64 tool decodes it instantly.

Which algorithms to use

MD5 and SHA-1 still appear for integrity checks where the threat is accidental corruption, not a malicious actor. They must not be used for signatures, certificates or passwords.

Two main uses

Integrity. Publishers list a file's SHA-256 so you can verify a download arrived intact and unmodified. Recompute the hash and compare; a mismatch means corruption or tampering. TLS certificate fingerprints (TLS vs SSL) are hashes for the same reason.

Password storage. Systems store a salted hash of your password, not the password. At login they hash what you typed and compare. If the database leaks, attackers get hashes, not passwords, and a slow salted hash makes recovering the originals expensive. This is central to authentication.

Salting and slow hashing

For passwords specifically, two extra measures matter:

• Salt: a unique random value per password, stored alongside the hash, so identical passwords hash differently and precomputed tables are useless.
• Slowness: password functions (bcrypt, scrypt, Argon2) are deliberately expensive, so an attacker can try far fewer guesses per second than with a fast hash like SHA-256.

A fast general-purpose hash is the wrong tool for passwords precisely because it is fast.