Hash (Cryptography)

A hash is a short string of characters computed from arbitrary data. The data can be a single word, a contract, or a two-hour-long movie. The result nevertheless always has the same length, for example 64 characters. This calculation only works in one direction: from the data you get the hash, but from the hash you cannot get the data back. You can think of it like a fingerprint. It is much smaller than the person, yet uniquely identifies them – and you cannot reconstruct a person from a fingerprint.

The fingerprint as proof of authenticity

The practical benefit lies in comparison. Anyone downloading a file from the internet can calculate its hash themselves. If it matches the value published by the provider, the file has not been altered in transit. Even a single flipped bit leads to a completely different hash. This means manipulations are noticed immediately.

The second major area of use is passwords. Reputable services never store passwords in plain text, only their hash. When logging in, the entered password is hashed again and compared with the stored value. If the database is stolen, the attacker only has a list of hashes. The actual password cannot simply be calculated back from it.

A common misconception is that hashing is the same as encryption. Encrypted data can be made readable again with the right key. A hash, on the other hand, is final. The original information is no longer fully contained within it.

Why the reverse direction doesn’t work

A hash function breaks the input into blocks and scrambles them over many rounds. In doing so, bits are swapped, shifted, and computed together. The procedure is publicly known and contains no secret. Nevertheless, it is practically impossible to reverse the steps, because information is lost and mixed together at every round.

A good hash function must fulfill three properties. First, it must not be possible to reconstruct the input from the result. Second, a tiny change in the input should affect roughly half of all output characters. Third, no two different inputs may produce the same hash. Such a coincidence is called a collision and would render the entire procedure worthless.

This is exactly where older methods failed. For MD5 and SHA-1, researchers found ways to deliberately create collisions. This made it possible to build forged documents that had the same hash as genuine ones. Today, SHA-256, whose output is 256 bits long, is considered secure above all others. For passwords, deliberately slow methods such as bcrypt are additionally used, so that attackers cannot try billions of attempts per second.

From Bitcoin to the download button

Hashes are best known through cryptocurrencies. In a blockchain, each block contains the hash of the previous block. Anyone wanting to forge an old entry would have to recalculate all subsequent blocks. In so-called mining, computers also search for a number that, together with the data, produces a hash with a specific form. This costs an enormous amount of electricity and is the reason why news about Bitcoin constantly talks about computing power.

Even outside of crypto, this principle is encountered daily, mostly invisibly. Every encrypted website connection uses hashes to verify digital signatures. Messengers like Signal display a security code that is based on the same principle. Software makers publish checksums alongside their downloads.

In the AI industry, hashes appear in another context. Image services compare hashes to detect known illegal material without storing the images themselves. And when training large models, they are used to remove duplicate texts from huge data collections. Comparing strings of characters is much faster than comparing entire documents.