Cyber Security Hashing

Hashing Is Not Encryption

Encryption is reversible: with the right key, ciphertext turns back into plaintext. Hashing is deliberately one-way — there is no key, and by design there is no operation that turns a hash's output (called a digest) back into the original input. If you need the original data back, you need encryption; if you only need to verify data without ever needing to recover it, hashing is the right tool.

• Deterministic — the same input always produces exactly the same digest, every time.
• Fixed-length output — a one-character input and a ten-gigabyte file both produce a digest of the same fixed size.
• Avalanche effect — changing even a single character of the input produces a wildly different, unrelated-looking digest.
• Practically irreversible — there is no feasible way to compute the original input just from the digest.
• Collision resistant — it should be extremely hard to find two different inputs that happen to produce the same digest.

A Real Example with Python

import hashlib

message = "Transfer $100 to Alex"
digest = hashlib.sha256(message.encode()).hexdigest()
print(digest)
# -> a 64-character hex string, always identical for this exact input

tampered = "Transfer $900 to Alex"
print(hashlib.sha256(tampered.encode()).hexdigest())
# -> a completely different 64-character string, even though only one digit changed

Use Case 1: Integrity Checking

When you download a piece of software, the publisher often lists the expected SHA-256 digest of the file alongside the download link. After downloading, you can hash the file yourself and compare the result to the published digest. If they match, the file arrived intact and unmodified; if even one byte was corrupted in transit or tampered with, the digests will look completely unrelated.

Use Case 2: Password Storage

Rather than storing user passwords as plaintext, a well-built system stores only the hash of each password. At login, it hashes the password the user just typed and compares that digest to the stored one — if they match, the password was correct, without the system ever needing to keep the actual password around. A plain general-purpose hash like SHA-256 alone isn't quite enough for this job, though: it's designed to be fast, which also makes it fast for an attacker to brute-force guess millions of candidate passwords per second against a stolen database. Purpose-built password hashing algorithms like bcrypt, scrypt, and Argon2 are deliberately slow and add a per-password random salt for exactly this reason.