What is a hash function? Digital fingerprints, explained

A hash function is a rule that turns any input, a word, a password or a whole film, into a short output of fixed length, called a hash or digest. The same input always gives the same hash, and a good hash function makes even a one-letter change produce a completely different one. A cryptographic hash function adds a promise: nobody can work backward from the hash to the input, or find two inputs with the same hash.

In short

• A hash is a fixed-length fingerprint of data: same data, same hash; different data, almost certainly a different hash.
• Cryptographic hashes such as SHA-256 are one-way: easy to compute, practically impossible to reverse or to forge.
• Hashes find data fast in hash tables, store passwords without storing the passwords, and prove files and blockchains haven't been changed.

What does a hash function do?

It boils anything down to a summary of fixed size, by a fixed algorithm of mixing and shuffling bits. SHA-256, the function standardized by the US National Institute of Standards and Technology in its Secure Hash Standard, FIPS 180-4, always produces 256 bits, usually written as 64 hexadecimal characters (the digits 0 to 9 and letters a to f, each standing for 4 bits). The word "hello" and a million-character text both come out as 64 characters.

Here is the effect in practice, computed with SHA-256. The two inputs differ only in the capital letter.

Input	SHA-256 hash
hello	2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Hello	185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

Count the bits that changed and it is 125 of the 256, almost exactly half, with no visible pattern. That is the avalanche effect: a tiny change to the input flips about half the output bits, unpredictably. It is what makes a hash useful as a fingerprint. If two hashes match, the data almost certainly matches; if a single comma has changed, the hashes won't look remotely alike.

What makes a hash function cryptographic?

Every hash function, including the simple ones inside a data structure, is deterministic, fast and gives a fixed-length output. A cryptographic one must also resist three attacks.

Property	What it rules out	Rough work to break SHA-256 by guessing
Preimage resistance	Given a hash, finding any input that produces it	About 2²⁵⁶ tries
Second-preimage resistance	Given an input, finding a different one with the same hash	About 2²⁵⁶ tries
Collision resistance	Finding any two inputs with the same hash	About 2¹²⁸ tries

Why is the last one easier? Because of the birthday paradox: in a room of only 23 people, two of them share a birthday more often than not, since there are 253 pairs to compare. Hunting for any matching pair is much faster than hunting for a match to one fixed value. For a 256-bit hash, a collision is expected after about 2¹²⁸ attempts, roughly 3.4 × 10³⁸.

That is still beyond reach. The note on Bitcoin mining puts the entire Bitcoin network at about 1,000 EH/s, or 10²¹ hashes a second, in November 2026. At that rate, 2¹²⁸ hashes would take about 11 billion years, nearly the age of the universe.

What is a collision, and has one ever been found?

A collision is two different inputs with the same hash. They must exist: there are infinitely many possible inputs and only 2²⁵⁶ possible outputs, so some inputs share. The security claim isn't that collisions don't exist, but that nobody can find one.

For older functions, somebody did. MD5, from 1992, has been broken for years. On 23 February 2017, researchers at CWI Amsterdam and Google announced the first real collision for SHA-1: two different PDF files with the same SHA-1 hash. It took about nine quintillion SHA-1 computations, roughly 6,500 CPU-years and 110 GPU-years of work. In December 2022, NIST announced it was retiring SHA-1, to be phased out of its remaining uses by 31 December 2030, and urged a move to SHA-2, the family SHA-256 belongs to, or SHA-3. No practical collision for SHA-256 has been published.

Where are hash functions used?

Three places matter most.

Hash tables. To store a contact under a name, a program hashes the name to a number and uses it to pick one of many slots; to find it again, it hashes the name and goes straight there. A lookup takes about the same time among a thousand names or a hundred million. These hashes are built for speed, not secrecy, though some languages randomize them: Python changes its string hashes each time a program starts, so an attacker can't feed in names chosen to pile into the same slot and slow it down.

Passwords. A well-run website never stores your password. It stores a hash of it, and when you log in, it hashes what you typed and compares. If the database is stolen, the thieves get hashes, not passwords. Two extra steps keep that true. A salt, a random value stored beside each hash and mixed into it, stops identical passwords from having identical hashes and defeats precomputed tables of common passwords. And a deliberately slow password-hashing scheme makes each guess costly. NIST's digital identity guidelines, SP 800-63B, require exactly this: passwords "SHALL be salted and hashed", with a salt of at least 32 bits and a cost factor set "as high as practical". The guidelines warn that attackers can compute "many billions of hashes per second" against a stolen file, which is why plain fast hashes aren't enough.

Proving nothing changed. Software downloads often list a SHA-256 hash; hash the file you received, and if it matches, it is the file that was published. A blockchain goes further: each block holds the hash of the one before, so altering an old block breaks every link after it. Bitcoin's Lightning Network uses a hash as a lock on a payment: whoever can show the input that produces a given hash can claim the money, and showing it proves the payment arrived.

Is hashing the same as encryption?

No, and the difference is the most common confusion. Encryption is two-way: with the right key, scrambled data turns back into the original. Hashing is one-way: there is no key, and nothing to decrypt. A website that can email you your forgotten password is not hashing it properly.

When people speak of "cracking" a hash, they mean guessing: hashing candidate inputs, such as common passwords, until one matches. That works only when the input is guessable, which is why a long, unusual password stays safe even if its hash leaks, and "password123" does not. Hashing is also not compression: a hash can't be turned back into the file, only compared with one.

Check yourself

• Without looking back, explain the avalanche effect and why it makes a hash useful as a fingerprint.
• Why must collisions exist, and why is SHA-256 still considered safe?
• What do a salt and a slow hashing scheme each add to password storage?

Sources

• Secure Hash Standard, FIPS 180-4 — National Institute of Standards and Technology, 2015
• NIST retires SHA-1 cryptographic algorithm — National Institute of Standards and Technology, 2022
• Announcing the first SHA1 collision — Google Security Blog, with CWI Amsterdam, 2017
• Digital Identity Guidelines, SP 800-63B — National Institute of Standards and Technology, 2025
• Password storage cheat sheet — OWASP Foundation