Hash

A hash is a short string of characters that a computer calculates from a file or a text. It doesn’t matter whether you feed in a single letter or an entire movie: the result is always the same length, for example 64 characters. The same input always means the same result. However, even a tiny change to the input completely changes the result. And you can’t reverse-calculate the original file from the result. That’s why you can think of a hash as a fingerprint of data.

The fingerprint as evidence

The practical benefit lies in comparison. Instead of comparing two huge files bit by bit, you only compare their short fingerprints. If they match, the files are identical with near certainty. This saves enormous amounts of computing time and storage space.

Just as important is the reverse case. When you download a program, the provider often publishes the corresponding hash alongside it. You can calculate the hash of your file yourself and compare the two. If they differ, the file was altered in transit or is corrupted. This is how you can detect manipulated downloads without having to trust the transmission path.

A third reason concerns how passwords are handled. Reputable services don’t store your password in plain text, only its hash. When you log in, your typed password is hashed again and compared with the stored value. If the database is stolen, the attackers only get unreadable strings of characters. Nothing can be reverse-calculated from them.

From file to string

The calculation is performed by what’s called a hash function. This is a defined computational procedure that breaks the data into blocks and repeatedly mixes, shifts, and recombines them. Well-known procedures are called SHA-256 or BLAKE3. They are deliberately designed so that every single input bit affects the entire result. This effect is called the avalanche effect.

Because the result is always the same length while the possible inputs are infinitely varied, coincidences are bound to occur. Two different files can produce the same hash. This is called a collision. With a good algorithm, this is so unlikely that it practically never occurs by chance. Older algorithms such as MD5, by contrast, are considered broken because collisions can be deliberately generated. For this reason, they are no longer used for security purposes.

A common misconception: hashing is not encryption. Encrypted data can be made readable again with the right key. A hash, on the other hand, is a one-way street where information is deliberately lost. That’s why even the operator of a service can’t read out your password, only reset it.

Hashes in blockchains, Git, and training data

Hashes are most visible in cryptocurrencies. Every block in a blockchain contains the hash of the previous block. If someone alters an old payment, the hash no longer matches, and the entire chain that follows becomes invalid. During mining, computers also keep searching for a matching number until a block’s hash takes on a certain form. It’s precisely this guessing that consumes the electricity reported on in the news.

Developers also work with hashes every day. The version control system Git names every stored change after its hash, for example as a string like a3f9c21. In the field of AI, hashes are used to find duplicate images or texts in huge training datasets. Such duplicates cost computing time and degrade the model.

In everyday life, you mostly encounter hashes invisibly. They’re embedded in check digits, in platforms' image recognition, and in every login. When a report states that a service stored passwords in plain text, that’s precisely why it’s a scandal: the fingerprint would have been enough.