What Is a Hash Function?

Hashing underpins huge parts of computing — from verifying downloads to storing passwords to powering blockchains. Yet "hash" gets used loosely. This guide explains what a hash function really is and the properties that make it so useful.

What is a hash function?

A hash function takes an input of any size — a word, a file, a whole database — and produces a fixed-size output called a hash or digest. Hash "Hello" with SHA-256 and you get a 64-character hex string; hash an entire movie and you get a string of exactly the same length. The output is a compact fingerprint of the input.

The properties that matter

A cryptographic hash function has several key properties:

• Deterministic. The same input always produces the same output.
• Fixed-size output. Any input maps to a digest of the same length.
• Avalanche effect. A tiny change in the input — even one bit — produces a completely different output.
• One-way (preimage resistance). Given a hash, you can't feasibly work backward to the input.
• Collision resistant. It's infeasible to find two different inputs that produce the same hash.

Try the avalanche effect yourself: hash "hello" and "hellp" in our hash generator and notice the digests share nothing in common.

Hashing is not encryption

A common confusion: hashing is one-way and keyless, while encryption is reversible with a key. You hash data to verify it; you encrypt data to protect and later recover it. There's no "unhash" operation. We unpack this fully in encoding vs encryption vs hashing.

What hashes are used for

• Integrity checks. Publishers list a file's hash so you can confirm your download wasn't corrupted or tampered with.
• Deduplication and indexing. Hashes make fast keys and detect identical data without comparing it byte by byte.
• Digital signatures. You sign the hash of a document rather than the whole thing.
• Message authentication. Combined with a key, hashing becomes HMAC.
• Password storage — but with an important twist (below).

The password exception

For storing passwords you need a slow hash, not a fast one. General-purpose hashes like SHA-256 are deliberately fast, which helps attackers brute-force a leaked database. Password hashing uses purpose-built, salted, slow algorithms like bcrypt, scrypt or Argon2. See bcrypt vs SHA-256 for why this matters.

Which hash should you use?

For security, use SHA-256 or SHA-512. Avoid MD5 and SHA-1 for anything adversarial — they're broken for collision resistance, though still fine for non-security checksums. Our MD5 vs SHA-1 vs SHA-256 guide compares them in detail.

Try it

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text with our hash generator, and for keyed authentication explore the HMAC generator.