How Cryptographic Hash Functions Work
A cryptographic hash function takes any input — a single character, a file, an entire database dump — and produces a fixed-length digest that looks like random bytes. The same input always produces the same output, but even a one-character change produces a completely different hash. This property is what makes hashing the foundation of passwords, file integrity, digital signatures, and blockchain.
All computations run in your browser via the Web Crypto API (SubtleCrypto.digest). No data is ever sent to a server.
SHA-1 vs SHA-256 vs SHA-512: Which to Use
SHA-1 (160-bit) is broken for security — Google's SHAttered attack demonstrated a practical collision in 2017. Avoid it for new applications. SHA-256 (part of SHA-2) is the current industry standard: used in TLS certificates, Bitcoin, git commits, and most password-hashing pipelines. SHA-512 is equally secure but produces a larger digest — useful on 64-bit systems where it can be faster than SHA-256 due to wider integer operations.
What Are Hashes Used For in Practice
1. Password storage: Never store plaintext passwords — store the hash (with a salt). Even if the database leaks, attackers see only hashes. 2. File integrity: Software downloads include SHA-256 checksums so you can verify the file wasn't tampered with in transit. 3. Git and version control: Every git commit is identified by its SHA-1 (now transitioning to SHA-256) hash of the tree, parent, author, and message. 4. Digital signatures: You sign the hash of a document, not the document itself, because hash size is fixed and manageable.
Why Hashing Is One-Way
Hash functions are designed to be computationally infeasible to reverse. Given a hash output, finding an input that produces it requires trying billions of inputs (a preimage attack). A good 256-bit hash has 2²⁵⁶ possible outputs — more atoms than in the observable universe — making brute force impossible without a severe weakness in the algorithm itself. This is fundamentally different from encryption, which is designed to be reversible with the right key.
HMAC and Keyed Hashing
HMAC (Hash-based Message Authentication Code) wraps a hash function with a secret key: HMAC-SHA256(key, message). Unlike a plain hash, HMAC proves both integrity (the content wasn't changed) and authenticity (only someone with the key could have produced it). APIs use HMAC signatures to verify webhook payloads, and JWT tokens (HS256) use it to prevent tampering with the payload.
SHA Algorithm Quick Reference
- SHA-1: 160-bit / 40 hex chars. Broken (collisions found 2017). Legacy only.
- SHA-256: 256-bit / 64 hex chars. Current standard. Use for new applications.
- SHA-512: 512-bit / 128 hex chars. Stronger digest, faster on 64-bit CPUs.
- SHA-3: NIST standard (2015). Different internal design (Keccak sponge). Not SHA-2.
- MD5: 128-bit. Completely broken — collisions trivially generated. Never use for security.
Frequently Asked Questions
What is a hash?
A hash is a fixed-length string of characters generated from input data using a mathematical algorithm. Even tiny changes to the input produce completely different hashes.
What is the difference between SHA-1, SHA-256, and SHA-512?
SHA-1 produces 160-bit (40 character) hashes, SHA-256 produces 256-bit (64 character) hashes, and SHA-512 produces 512-bit (128 character) hashes. SHA-256 and SHA-512 are more secure than SHA-1.
Is my data safe?
Yes. All hashing is done 100% in your browser using the WebCrypto API. Your text never leaves your computer or is sent to any server.
Can I reverse a hash back to the original text?
No. Hashing is a one-way function. Once hashed, the original data cannot be recovered. This is why hashes are used for security.
What are hashes used for?
Hashes are used for password storage, file integrity verification, digital signatures, blockchain, and detecting changes in data.
Why was SHA-1 deprecated?
SHA-1 is considered cryptographically broken due to collision vulnerabilities discovered in 2017. SHA-256 and SHA-512 are recommended for new applications.