Hashing explained: what MD5, SHA-256 and a hash are for
Hashes show up in downloads, passwords, blockchains, and git. But what is a hash, really? Here's the concept without the math.
A hash is a fingerprint for data
A hash function takes any input — a word, a file, an entire movie — and produces a fixed-length string of characters (the "hash" or "digest"). The same input always produces the same hash. Change even one byte, and the hash changes completely. Think of it as a unique fingerprint for a piece of data.
The key properties
- Deterministic: same input → same output, every time.
- Fixed length: a 3-byte file and a 3-GB file both produce a hash of the same size.
- One-way: you can't reverse a hash back into the original data. This is the crucial difference from encoding or encryption.
- Avalanche effect: a tiny change in input produces a totally different hash.
What hashes are used for
- Verifying downloads: a site publishes a file's SHA-256; you hash your download and compare. Match = the file wasn't corrupted or tampered with.
- Storing passwords: sites store the hash of your password, not the password itself. When you log in, they hash what you typed and compare.
- Detecting changes: git uses hashes to identify every commit and file.
- Deduplication: identical files share a hash, so systems can spot duplicates instantly.
MD5 vs SHA-256: which to use
MD5 is old and considered broken for security — it's possible to craft two different inputs with the same MD5 hash. It's fine for non-security checks (quick file fingerprints) but never for passwords or signatures. SHA-256 is the modern standard: secure, widely supported, and the right default for anything that matters.
Not encryption
Hashing is one-way and has no key. You can't "un-hash" data. Encryption is two-way and reversible with a key. Don't confuse them.