Understand cryptographic hash functions and their applications.
Hash functions are mathematical algorithms that convert arbitrary data into a fixed-size string of characters. They are widely used for data integrity, password storage, and digital signatures.
#
A hash function takes input data (of any size) and produces a fixed-size output (hash value). Key properties:
1. Deterministic: Same input always produces same output 2. Fixed Size: Output length is constant regardless of input size 3. One-Way: Cannot be reversed to get original input 4. Avalanche Effect: Small change in input produces large change in output
#
MD5:
SHA-1:
SHA-256:
SHA-512:
#
``javascript
// Create SHA-256 hash
const hash = await crypto.subtle.digest('SHA-256', data);
// Convert to hex string const hexHash = Array.from(new Uint8Array(hash)) .map(b => b.toString(16).padStart(2, '0')) .join(''); ``
#
A collision occurs when two different inputs produce the same hash. A secure hash function should be collision-resistant.
#
Preimage resistance means it's computationally infeasible to find an input that produces a given hash.
#
Second preimage resistance means it's computationally infeasible to find a second input that produces the same hash as a given input.
#
1. Data Integrity: Verify file downloads 2. Password Storage: Store hash of passwords (always use salt!) 3. Digital Signatures: Sign documents 4. Blockchain: Hash blocks for integrity 5. Deduplication: Identify duplicate files
#
Never store plain passwords! Always use salt:
``
hash = SHA-256(salt + password)
``
Salt should be:
#
For passwords, use specialized KDFs:
These are designed to be slow to prevent brute-force attacks.
A hash function converts arbitrary data into a fixed-size output with specific properties.
No, hash functions are designed to be one-way. You cannot get the original input from a hash.
Use SHA-256 for most applications. Use bcrypt/scrypt/Argon2 for passwords.
Yes, SHA-256 is considered secure for cryptographic purposes.
Salting is adding random data to input before hashing to prevent rainbow table attacks.
It should be computationally infeasible for secure hash functions. This is called a collision.
Compare the hash of the downloaded file with the published hash.
Hashing is one-way, encryption is two-way (can be decrypted with a key).
Try our tools to apply what you have learned in real-time.