FAQ
What is a hash?
A hash function takes any input and produces a fixed-length output (the hash or digest). The same input always produces the same output, but even a single character change results in a completely different hash. The process is one-way - you cannot reconstruct the original input from the hash alone.
What are hashes actually used for?
A few common real-world uses:
• File integrity - software download pages often publish the SHA-256 hash of an installer so you can verify that what you downloaded matches what they published, and was not tampered with in transit.
• Password storage - websites should never store your password in plain text. Instead they store its hash; when you log in, they hash your input and compare. A breach exposes only hashes, not the original passwords.
• Git commits - every commit in Git is identified by its SHA-1 hash. If even one byte of history changes, the hash changes, making tampering detectable.
• Deduplication - comparing hashes is much faster than comparing file contents byte-by-byte, so storage systems use them to detect duplicate files.
• Data fingerprinting - a hash gives any blob of data a short, unique fingerprint useful as a cache key, ETag, or content-addressed identifier.
Which algorithm should I use?
For security-sensitive purposes (digital signatures, integrity verification, certificates) use SHA-256 or SHA-512. MD5 and SHA-1 have known weaknesses and should not be trusted for security. They are still fine for non-security uses like quickly checking whether a downloaded file matches an expected checksum.
Why does a tiny change produce a completely different hash?
This is called the avalanche effect and is a deliberate design property. It ensures that similar inputs produce wildly different outputs, making it impossible to infer anything about the input from the hash or to find two inputs that produce the same hash (a collision).
Can a hash be reversed?
No - that is the whole point. Hash functions discard information during computation, so there is no mathematical way to go backwards. The only attack is brute force: try many inputs and compare their hashes. This is why short or common passwords remain vulnerable even when stored as hashes.