Back to blog 
29. 08. 2026 Hash functions are one of the most important tools in modern computer science. At first glance they are invisible - they are used to verify file integrity, store passwords, create digital signatures, and power blockchain technology. Without hash functions, the internet as we know it today simply could not function.
What is a Hash Function?
A hash function is a mathematical function that takes an input of any length (text, file, image) and returns an output of fixed length - called a "hash" or "fingerprint." This output is always the same length, regardless of whether the input is a single character or an entire high-definition movie.
The most important properties of hash functions:
- Deterministic: The same input always returns the same output
- Fast: Computing a hash is quick
- Avalanche effect: Changing a single character in the input completely changes the output
- One-way: The original input cannot be reconstructed from the hash
- Collision resistant: Two different inputs should not produce the same hash
Avalanche Effect Example
The best way to understand hash functions is through a concrete example. Let's look at SHA-256, one of the most widely used hash functions:
SHA-256("hello world") = b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-256("Hello world") = 64ec88ca00b268e5ba1a35678a1b5316d212f4f366b2477232534a8aeca37f3c
SHA-256("hello world!") = 7509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9
The difference between "hello" and "Hello" is just one capital letter, yet the result is completely different. This is the avalanche effect - a minimal change in input causes a drastic change in output.
Common Hash Functions
| Function | Output Length | Status | Typical Use |
|---|---|---|---|
| MD5 | 128 bits | Unreliable (collisions found) | Non-critical file checksums |
| SHA-1 | 160 bits | Deprecated | Legacy Git |
| SHA-256 | 256 bits | Secure, recommended | Passwords, digital signatures, blockchain |
| SHA-512 | 512 bits | Secure, recommended | High-security applications |
| bcrypt | Variable | Secure for passwords | Password storage |
| Argon2 | Variable | Newest, best for passwords | Modern password systems |
Where Are Hash Functions Used?
Hash functions are everywhere. Here are the most important use cases:
- Password storage: Websites do not store passwords in plain text. They store only the hash. When a user logs in, the input password is hashed and compared to the stored hash
- File integrity: When downloading large files (e.g., OS ISO images), a hash is published so recipients can verify the file is uncorrupted
- Digital signatures: When signing documents, the entire file is not signed - only its hash
- Blockchain: Each block in a blockchain contains the hash of the previous block, creating a tamper-proof chain
- Git: Each commit in Git has its own hash that uniquely identifies the code state
- HTML and CSS: Cache busting - appending a hash to filenames (e.g., style.a3f9b2.css) to force cache refresh
Password Hashing in Practice
The most common use of hash functions you will encounter is password storage. Here's how it works in practice:
// User registration:
1. User enters password: "mySecretPassword123"
2. Server computes hash:
bcrypt("mySecretPassword123") → $2b$12$N9qo8uLOickgx2ZMRZoMy...
3. Only the hash is stored in the database, never the plain text password
// User login:
1. User enters password: "mySecretPassword123"
2. Server computes hash from input
3. Server compares hash with stored hash
4. If they match → login successful
5. If they don't match → error
Why is this important? If someone breaches the database, they don't get passwords - they get only hashes. And since hash functions are one-way, the original password cannot be derived from the hash.
Salting Passwords
A plain hash is not enough for secure password storage. Why? Because an attacker could use a "rainbow table" - a precomputed table of hashes for common passwords. The solution is salting - adding a random string of characters to the password before hashing:
// Without salt - vulnerable:
SHA-256("password123") → always the same result for all users with the same password
// With salt - secure:
SHA-256("password123" + "x7K9mP2q") → unique hash for this user
SHA-256("password123" + "b3R8nL5w") → different hash for another user
// Even if two users have the same password,
// their hashes are completely different
Hash is Not Encryption!
This is a very common misconception that needs to be clarified. Hashing and encryption are two different things:
| Property | Hash | Encryption |
|---|---|---|
| Direction | One-way (no return) | Two-way (can be decrypted) |
| Purpose | Verify integrity | Hide content |
| Key | No key required | Requires a key (symmetric or asymmetric) |
| Example | SHA-256, bcrypt | AES, RSA |
| Original recovery | Not possible | Possible with the correct key |
Simply put: hashing is like a meat grinder - once you put meat through it, you can't get it back in its original form. Encryption is like a safe - with the right key, you can open it and retrieve the original contents.
Why Does This Matter?
Hash functions are the foundation of digital security. Every time you log into a website, download a file, sign a digital document, or make a cryptocurrency transaction - hash functions work in the background to ensure data is authentic and unaltered.
Understanding hash functions is the first step toward understanding broader security concepts like encryption, digital signatures, and authentication. In the next article, we will cover encryption in detail and how it differs from hashing. For a practical demonstration of password hashing, you can view the example in my tutorial: PHP Forms with Secure Password Protection.