Hashing
The process of converting data into a fixed-size string of characters using a mathematical function, designed to be irreversible and produce unique outputs for unique inputs.
Detailed Explanation
Hashing transforms input data into a fixed-length output (hash) that is practically impossible to reverse. Unlike encryption, hashing is one-way—you cannot get the original data from the hash. The same input always produces the same hash, making hashes useful for data integrity verification.
Common hash functions include SHA-256 (used in blockchain and data integrity), bcrypt/scrypt/Argon2 (designed for password hashing with built-in salting), and MD5 (cryptographically broken—never use for security). Hashing is used for password storage, data integrity checks, digital signatures, hash tables (data structures), and blockchain.
Why It Matters
Hashing is essential for password security, data integrity, and many cryptographic protocols. Understanding when and how to use hashing correctly is critical.
Real-World Example
When you create a password, the server hashes it with bcrypt and stores only the hash. When you log in, the server hashes your input and compares it to the stored hash. Even if the database is breached, attackers only get hashes, not passwords.
When to Use
For password storage, data integrity verification, digital signatures, and hash-based data structures. Never for reversible data storage.
Advantages
- One-way: cannot be reversed
- Same input always produces same output
- Fixed output size regardless of input
- Fast computation for data integrity checks
- Collision-resistant with modern algorithms
Disadvantages
- Cannot be reversed (not suitable for data you need to recover)
- Collision vulnerabilities in old algorithms (MD5, SHA-1)
- Password hashing must use slow algorithms (bcrypt) to resist brute force
- Rainbow tables can attack unsalted hashes
- Key management not applicable (no keys involved)
Related Terms
Frequently Asked Questions
What is the difference between hashing and encryption?
Hashing is one-way (cannot be reversed). Encryption is two-way (can be decrypted with the key). Use hashing for passwords and integrity checks. Use encryption for data you need to read later.
How do I hash passwords?
Use bcrypt, scrypt, or Argon2 with a work factor of at least 12. These algorithms are intentionally slow to resist brute force attacks. Never use MD5, SHA-1, or SHA-256 alone for password hashing.
What is a salt in password hashing?
A salt is random data added to the password before hashing. It ensures that identical passwords produce different hashes, preventing rainbow table attacks. Modern algorithms (bcrypt, Argon2) include salting automatically.
Is SHA-256 secure for passwords?
No. SHA-256 is too fast for password hashing—it allows billions of guesses per second. Use bcrypt, scrypt, or Argon2 instead, which are deliberately slow to make brute force attacks impractical.
What is hash collision?
A hash collision occurs when two different inputs produce the same hash output. MD5 and SHA-1 have known collision vulnerabilities. SHA-256 and BLAKE3 are currently collision-resistant. For security applications, use only well-vetted hash functions.