What Is a Hash and How Does It Work?
Last updated 2026-09-12
A hash function takes any input and produces a fixed-length string of characters — the same input always produces the same hash, but you can't reverse it back to the original.
Understand the core properties
A good cryptographic hash is deterministic (same input always gives the same output), fast to compute, and produces wildly different output for even a tiny change in input (the "avalanche effect").
Understand why it's one-way
Hash functions are designed so there's no practical way to work backward from the hash to the original input — unlike encryption, which is meant to be reversed with a key.
Know common uses
Verifying a downloaded file hasn't been tampered with, storing password verification data (never the password itself), and detecting duplicate content.
Example
The SHA-256 hash of "hello" is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 — change one letter and the entire hash changes completely.
Important Considerations
- Hashing is not encryption — never use a hash alone to "protect" data you need to read back later.
- MD5 and SHA-1 are now considered cryptographically broken for security purposes (though still fine for non-security uses like checksums) — SHA-256 or SHA-512 are the current standard.
- Password storage systems use additional techniques (salting, deliberately slow algorithms like bcrypt) on top of hashing — a plain fast hash like SHA-256 is not sufficient for storing passwords securely.
Frequently Asked Questions
- Can I decode a hash back to the original text?
- No — that's the point of a cryptographic hash. The only way to "crack" one is to guess inputs and hash them until you find a match, which is why weak/short inputs are vulnerable.
- Why do two different files sometimes need the same hash algorithm to compare?
- Hashes from different algorithms (e.g. SHA-1 vs SHA-256) have different lengths and values even for the same input — you can only compare hashes generated with the same algorithm.