Hashing

Hashing is a method that transforms any input – a word, a sentence, an entire file – into a string of fixed length. This string is called the hash value. The function that computes it is called a hash function. Regardless of whether the input has three letters or three million: the hash value is always the same length. And crucially, there’s something you can’t do: you cannot calculate back from the hash value what the original input was.

Why hash values protect passwords

Websites need to store passwords somewhere – but it would be dangerous to keep them in plain text. If the database is stolen, an attacker would have immediate access to all accounts. That’s why well-built systems only store the hash value of the password, never the password itself.

When logging in, the user enters their password, the site computes the hash value and compares it with the stored one. If they match, access is granted. The actual password never leaves the user’s own computer and is never stored. Even someone who steals the database only gets a list of hash values – which doesn’t get them very far on its own.

A similar principle applies to files. Software vendors often publish the hash value of an installation program. Anyone downloading the file can calculate the hash value themselves and compare it. If it matches, the file wasn’t altered or swapped along the way.

How a hash function computes

A hash function processes the input in several mathematical steps: it breaks the text into blocks, combines them with fixed computational values, and mixes the results multiple times. The exact procedure differs depending on the algorithm. Widely used algorithms are called SHA-256 or bcrypt; SHA-256, for example, always produces a 64-character hexadecimal value – that is, a sequence of digits and the letters A through F.

An important property here is so-called collision resistance: two different inputs should never produce the same hash value. In practice this is not mathematically guaranteed, but with good hash functions it is so unlikely that it plays no role in practice. If you change a single character of the input, the hash value looks completely different – this makes it easy to detect even the smallest changes.

There are also hash functions that are deliberately slow – such as bcrypt or Argon2. That sounds like a drawback, but it’s intentional: anyone wanting to crack stolen hash values has to try millions of passwords. If every attempt takes just one millisecond longer, trying them all becomes many times more costly.

Hashing in everyday life, technology, and the news

Hashing is embedded in almost every piece of software that manages passwords: in social networks, banking apps, operating systems. When a data breach reveals that passwords were stored “hashed,” that’s good news – but it doesn’t automatically mean all users are safe. If outdated hash functions like MD5 were used, many simple passwords can be cracked quickly using pre-built tables known as rainbow tables.

In blockchain technology, which underlies cryptocurrencies like Bitcoin, hashing is a core building block. Each block contains the hash value of the previous block. If someone later alters an entry, its hash value changes – and so does every subsequent block. This makes the chain tamper-resistant.

Hashing also appears constantly in software development: as a fast way to organize and retrieve data internally. A so-called hash table can look up a single entry in a large dataset in constant time – regardless of how many entries exist overall. There, hashing isn’t a security concept but an efficiency tool.