A cryptographic hash function takes any input — a word, a file, a whole disk — and produces a short, fixed-length digest (SHA-256 always outputs 256 bits, 64 hex characters). It is one of the most useful tools in all of security, and it has three defining properties.
The three properties
- Deterministic — the same input always produces the same digest. Hash a file today and next year; identical bytes give an identical hash.
- One-way — from a digest you cannot feasibly recover the input. The function is easy to run forwards and effectively impossible to run backwards.
- Avalanche — change the input by a single bit and roughly half the output bits flip. Similar inputs give completely dissimilar digests, so a digest leaks nothing about how close two inputs were.
A fourth, related property is collision resistance: it should be infeasible to find two different inputs with the same digest. (This is why old hashes like MD5 and SHA-1 were retired — collisions became findable.)
See the avalanche
Below, type any text and watch its real SHA-256 digest. The widget also hashes the same text with a single character changed and highlights how many digits differ — usually about half. Tiny change in, total change out.
What hashes are for
- Integrity — publish a file's hash; anyone can re-hash their copy and confirm it matches, proving it wasn't corrupted or tampered with in transit. This is how downloads, software updates and blockchains detect changes.
- Password storage — a service should never store your actual password. It stores its hash; at login it hashes what you typed and compares. A breach then leaks hashes, not passwords.
The password caveat
Plain fast hashing is not enough for passwords, and this is where beginners get it wrong. Attackers precompute hashes of common passwords, so real systems add two things: a salt (a unique random value per password, so identical passwords get different hashes and precomputation fails) and a deliberately slow hashing scheme (bcrypt, scrypt or Argon2) that makes billions of guesses per second impractical. Same core idea, hardened for adversaries.
Hashing gives us integrity and lets us check secrets without storing them. But it does not let two parties share a secret to keep messages confidential. For that we need keys — and a surprising trick for agreeing on one in the open. That's next.