Hashing

A computer engineering student seeking to simplify security concepts

We always hear the term hashing in many fields, such as cybersecurity, databases, and mathematics.

But what exactly is hashing, and why is it useful?

What Is Hashing?

Hashing is a process in which a mathematical function takes some input data and produces a fixed-length output called a hash, hash value, or message digest.

The input could be:

• A password
• A text message
• An image
• A file
• An entire program

The output is normally represented as a sequence of numbers and letters (hexadecimal number).

The length of the output depends on the hashing algorithm — not the size of the input.

For example, SHA-256 always produces a 256-bit hash, whether the input is one word or a 10 GB file.

A Simple Example

Imagine that our hashing function is:

Hash = input mod 2

This function returns the remainder after dividing the input by 2.

Examples:

5 → 1

4 → 0

1000 → 0

9999 → 1

Regardless of the input size, the output is always one digit: either 0 or 1.

This is technically a hashing function, but it would be completely useless for security because it has only two possible outputs.

Every even number produces 0, while every odd number produces 1.

Is This Function Reversible?

No.

If I give you the output 0, you cannot know whether the original input was 4, 1000, 5364, or any other even number.

There is no single correct input to reverse back to.

However, the function is still extremely weak because an attacker can easily try possible inputs until one produces the required output.

This is called guessing or brute forcing, not reversing the function.

Connecting Hashing to Security

Suppose a platform needs to store users’ passwords.

Saving passwords as plain text would be dangerous. If an attacker stole the database, every password would be immediately visible.

Instead, the platform stores a password hash.

When the user creates a password:

Password → Password-hashing algorithm → Stored hash

When the user logs in again:

Entered password → Same algorithm → New hash

The platform compares the new hash with the stored hash:

• If they match, the password is accepted.
• If they do not match, the password is rejected.

The platform does not need to save the original password.

Important Clarification

Hashing protects the password while it is stored in the database.

It does not protect the password while it travels from the user’s device to the server. HTTPS/TLS encryption is responsible for protecting it during transmission.

What Would Happen with Our Weak Function?

Imagine that our platform used input mod 2 for passwords:

• Client A enters 5364 → Hash: 0
• Client B enters 4854 → Hash: 0
• Client C enters 4561 → Hash: 1
• Client D enters 8945 → Hash: 1

This would be a disaster.

Get Seif Tawfik’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Clients A and B have different passwords, but both produce the same hash. The system may accept one password in place of the other.

This situation — where two different inputs produce the same hash — is called a collision.

Real Password Storage

Real platforms must not use a simple function or even plain SHA-256 for passwords.

SHA-256 is intentionally fast. That is useful for checking files, but it also allows attackers to test millions or billions of password guesses quickly.

Passwords should instead be processed using a slow, password-specific algorithm such as:

• Argon2id
• scrypt
• bcrypt
• PBKDF2

A unique random value called a salt should also be added to every password before hashing.

Therefore, a simplified real process looks like this:

Password + Unique Salt → Argon2id → Stored hash

The salt means that two users with the same password will still have different stored hashes.

You can read the practical recommendations in the OWASP Password Storage Cheat Sheet.

SHA-256

SHA-256 is an example of a strong cryptographic hashing algorithm.

It converts input data into a fixed 256-bit, or 32-byte, output. That output is commonly displayed as 64 hexadecimal characters.

A good cryptographic hash function should have three important properties:

1. It should be computationally impractical to discover the original input from its hash.
2. A small change in the input should produce a very different hash.
3. It should be computationally impractical to find two different inputs with the same hash.

Its official technical specification is available in NIST FIPS 180–4.

The Collision Problem

A collision occurs when two different inputs produce the same hash:

Hash(Input A) = Hash(Input B)

Collisions must mathematically exist because a hashing algorithm accepts an enormous number of possible inputs but produces outputs of a fixed length.

Therefore, a secure hashing algorithm does not magically remove collisions.

Instead, it makes finding one require an unrealistic amount of time and computing power.

Why Are Collisions Dangerous?

Imagine that an attacker creates two documents:

• A harmless document
• A malicious document

The documents are different, but a weak hashing algorithm gives them the same hash.

The attacker sends the harmless document to a trusted organization to be digitally signed. Because the malicious document has the same hash, its signature may also appear valid.

A real example occurred when researchers used weaknesses in MD5 to create a fraudulent Certificate Authority certificate.

MD5 should no longer be used when collision resistance is required, especially for digital signatures and security-sensitive integrity checks. This is confirmed by IETF RFC 6151.

Hashing Downloaded Files

Software publishers commonly publish a hash beside a downloadable file.

After downloading the file, you calculate its hash and compare it with the published value:

• Different hashes mean the file has changed.
• Matching hashes give strong evidence that you received the intended file.

However, two conditions are important:

1. The publisher must use a secure algorithm such as SHA-256.
2. You must obtain the expected hash from a trusted source.

If an attacker can replace both the file and the hash displayed on the website, comparing them will not protect you. Digitally signed software provides stronger proof because it connects the file to the publisher’s private key.

Final Idea

A hash acts like a digital fingerprint for data.

Different data should produce different fingerprints, and even a tiny change should completely change the result.

Collisions are mathematically unavoidable, but strong cryptographic hashing algorithms make deliberately finding them practically impossible with current technology.