What is a Hash?
A hash (also called a digest) is the process of converting arbitrary-length input data into a fixed-length output string using a mathematical algorithm. This output is called a "hash value", "digest", or "fingerprint".
Hash functions have these core properties:
- Deterministic: The same input always produces the same hash.
- Fast computation: Hashes can be computed quickly for any data.
- One-way: It is practically impossible to reverse a hash back to the original input.
- Collision-resistant: It is extremely difficult to find two different inputs that produce the same hash.
- Avalanche effect: A tiny change in the input produces a completely different hash.
Common Uses of Hash Algorithms
- Data integrity: Verify downloaded files by comparing MD5 or SHA-256 hashes.
- Password storage: Servers store salted hashes (e.g. PBKDF2, bcrypt) instead of plaintext passwords.
- Digital signatures: Signing a hash digest is more efficient than signing the original message.
- Blockchain: Each block contains the previous block's hash, forming an immutable chain.
- Git version control: Git uses SHA-1 hashes to identify every commit.
- Deduplication: Quickly determine if two files are identical by comparing hashes.
Plain Hash vs HMAC vs PBKDF2
| Type | Characteristics | Typical Use Case |
|---|
Plain Hash
(MD5, SHA-1, SHA-256…) | No key required. Computes digest directly. Fast, but does not prevent tampering. | File checksums, data deduplication |
HMAC
(HMAC-SHA256, HMAC-SHA512…) | Requires a secret key. Verifies both data integrity and authenticity. | API signing, JWT tokens, message authentication |
PBKDF2
(Password-Based Key Derivation Function 2) | Requires password + salt + iterations. Deliberately slow to resist brute-force attacks. | Password hash storage, encryption key derivation |
Hash Algorithm Overview
- MD5: 128-bit output, fast but broken. Do not use for security; checksums only.
- SHA-1: 160-bit output, collision vulnerabilities found. Not recommended for new systems.
- SHA-256 / SHA-512: Part of the SHA-2 family. Widely used, secure — recommended for most scenarios.
- SHA-3: The latest NIST hash standard, structurally different from SHA-2, providing additional security.
- RIPEMD-160: 160-bit output, commonly seen in Bitcoin address generation.
- HMAC series: Combines hash functions with a secret key to verify both integrity and authenticity.
- PBKDF2: Iteratively derives an encryption key from a password — an industry standard for password storage.
How to Choose a Hash Algorithm?
- File checksums: MD5 or SHA-256 (balance of speed and security).
- Password storage: PBKDF2 (with a sufficiently large salt and high iteration count, e.g. 100,000+).
- API signing / JWT: HMAC-SHA256 or HMAC-SHA512.
- Blockchain / digital signatures: SHA-256 or SHA3-256.
- High-security scenarios: SHA-512 or SHA3-512.