About Cryptographic Hashing
Hashing is a one-way function that converts input data into a fixed-length string. The same input always produces the same hash, but you cannot reverse the hash to get the original input.
Hash Properties
- Deterministic: Same input always produces same output
- One-way: Cannot reverse the hash to get original input
- Fixed-length: Output is always the same size regardless of input
- Avalanche effect: Small input changes produce completely different hashes
Common Uses
- Password Storage: Hash passwords before storing (never store plaintext)
- Data Integrity: Verify files haven't been modified
- Digital Signatures: Create signatures for authentication
- Blockchain: Proof-of-work and linking blocks
- Deduplication: Identify duplicate files or data
Algorithm Comparison
- SHA-256: 256-bit output, widely used, secure and fast
- SHA-384: 384-bit output, more secure than SHA-256
- SHA-512: 512-bit output, highest security level
- SHA-1: Deprecated, should not be used for new applications
Frequently Asked Questions
Can I use this to hash passwords?
For demonstration only. In production, use specialized password hashing algorithms like bcrypt, Argon2, or PBKDF2 which are designed to be slow and resist brute-force attacks.
What's the difference between hashing and encryption?
Hashing is one-way (cannot be reversed). Encryption is two-way (can be decrypted with a key). Use hashing for passwords, use encryption for data that needs to be retrieved.
Are SHA-256 hashes secure?
Yes, SHA-256 is currently considered secure and is widely used. It's resistant to collision attacks and is suitable for most applications.
Can two different inputs produce the same hash?
Theoretically possible but extremely unlikely (called a collision). SHA-256 has a 2^256 possible output space, making collisions practically impossible.
How do password hashes work?
When you create an account, your password is hashed and stored. When you log in, your entered password is hashed and compared to the stored hash. This way, even if the database is compromised, attackers don't have your actual password.