In previous posts, I covered symmetric and asymmetric encryption. Both help protect information by making it unreadable without the correct key. Another term that often comes up alongside encryption is hashing. So, what is hashing, and where does it fit into cybersecurity?
Hashing Basics
Hashing takes an input, such as a message or a file, and calculates a value called a hash or digest. With an algorithm such as SHA-256, the output has a fixed length regardless of whether the input is a short sentence or a large download.
Think of it as a digital fingerprint. You can compare fingerprints to help check whether data has changed, without comparing every part of the original files yourself.
The same input produces the same hash when the same algorithm is used. Even a small change, such as replacing one letter, will usually produce a very different result. Secure cryptographic hash functions are also designed to make it impractical to recover an input from its hash or deliberately find two different inputs with the same hash. Such a matching pair is called a collision.
Hashing vs. Encryption
The main difference is their purpose:
- Encryption protects confidentiality. Someone with the correct key can decrypt the information and read it again.
- Hashing produces a digest for comparison. There is no decryption key that turns the hash back into the original message.
However, this does not mean that hashing makes a weak password impossible to discover. An attacker can hash likely guesses and compare the results.
Example Use Case: Checking a Download
Imagine you download a software installer and the publisher provides its SHA-256 hash.
- Download the file from the publisher’s official website.
- Calculate the SHA-256 hash of the downloaded file using a local tool.
- Compare your result with the hash published by the developer.
If the values differ, the file does not match the expected download. It may be incomplete, corrupted or modified.
A matching hash is only as trustworthy as the reference you compare it against. If an attacker replaces both the file and the published hash, that comparison alone will not expose the change. It also does not prove that the software itself is harmless.
How Does Hashing Help Protect Passwords?
A service should normally store a password hash rather than the password itself. When you sign in, the service uses a password verification function to check your entry against the stored result.
Password storage needs a dedicated algorithm, such as Argon2id, and a unique random salt for each password. A salt is stored alongside the hash and helps prevent identical passwords from producing identical stored results. Password hashing algorithms deliberately make guessing more expensive; a fast general-purpose hash such as SHA-256 alone is not suitable for storing passwords.
Why Does It Matter?
Hashing helps us check file integrity and is part of systems that verify passwords and digital signatures. It serves a different purpose from encryption, but both are useful building blocks for protecting information.
The next time you see a long SHA-256 value beside a download, you will know what it is there for: a way to compare the file you received with the file you expected.
Comments are closed.