What Is a Hash Function? Understanding MD5, SHA, and Cryptographic Hashing

What Is a Hash Function?

A hash function takes an input of any size — a single character, a paragraph, or an entire file — and produces a fixed-length output called a hash or digest. No matter how large the input, the output is always the same length for a given algorithm. For example, MD5 always produces 32 hexadecimal characters, while SHA-256 always produces 64.

Key Properties of Hash Functions

Good cryptographic hash functions share these essential properties:

• Deterministic: The same input always produces the same hash.
• Fast computation: The hash can be calculated quickly for any input size.
• Pre-image resistance: Given a hash, it is computationally infeasible to find the original input.
• Small changes, big differences: Changing even one bit of the input produces a completely different hash (avalanche effect).
• Collision resistance: It is extremely difficult to find two different inputs that produce the same hash.

Common Hash Algorithms

MD5

Developed in 1991, MD5 produces a 128-bit hash (32 hex characters). It was once widely used for file verification but is now considered broken for security purposes — researchers can generate collisions in seconds. It remains useful for non-security checksums.

SHA Family

The Secure Hash Algorithm family, designed by the NSA:

• SHA-1: Produces 160-bit hashes. Deprecated for security use since 2017 when Google demonstrated a practical collision attack.
• SHA-256: Part of SHA-2, produces 256-bit hashes. Currently the standard for most security applications, including SSL certificates and blockchain.
• SHA-384 and SHA-512: Longer variants of SHA-2 for higher security requirements.
• SHA-3: A newer algorithm with a different internal structure, serving as a backup if SHA-2 is ever compromised.

Other Algorithms

• bcrypt: Designed specifically for password hashing, with built-in salt and adjustable work factor.
• Argon2: The modern winner of the Password Hashing Competition, resistant to GPU-based attacks.

Real-World Applications

• Password storage: Websites store password hashes, not plaintext. When you log in, your password is hashed and compared to the stored hash.
• File integrity verification: Download sites publish hash values so you can verify files were not corrupted or tampered with.
• Digital signatures: Hashes are a core component of digital signature algorithms used in code signing and document verification.
• Blockchain: Every block contains the hash of the previous block, creating an immutable chain.
• Data deduplication: Storage systems use hashes to identify duplicate data blocks.