Hash Functions Explained:
MD5, SHA-256 & Cryptographic Hashing

1. What is a Hash Function?

A hash function is a mathematical algorithm that converts input data of any size into a fixed-size output called a hash, digest, or checksum. Think of it as a fingerprint for data.

No matter how large the input (a single character or a 10GB file), the output is always the same size. SHA-256 always produces 256 bits (64 hexadecimal characters).

Key Concepts:

• Hash/Digest: The fixed-size output of a hash function
• Collision: When two different inputs produce the same hash
• One-way function: Cannot compute input from output
• Deterministic: Same input always produces same output

2. Properties of Cryptographic Hash Functions

Avalanche Effect Demonstration:

Input: "Hello"
SHA-256: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

Input: "hello" (just lowercase 'h')
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

// Completely different outputs from a single character change!

3. Algorithm Comparison Table

Quick Recommendation:

• General security: SHA-256
• Passwords: bcrypt, Argon2 (NOT SHA-256 directly)
• Performance-critical: BLAKE2
• Non-security checksums: MD5 is acceptable

4. Hash Function Use Cases

5. Password Hashing (bcrypt, Argon2, scrypt)

Password Hashing Algorithm Comparison:

bcrypt Example:

// Node.js with bcrypt
const bcrypt = require('bcrypt');

// Hash a password (cost factor 12 = 2^12 iterations)
async function hashPassword(password) {
    const saltRounds = 12;
    return await bcrypt.hash(password, saltRounds);
}
// Output: $2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4.FSdcqC.xTTBm/G

// Verify a password
async function verifyPassword(password, hash) {
    return await bcrypt.compare(password, hash);
}

Argon2 Example (Python):

from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,        # Number of iterations
    memory_cost=65536,  # 64MB of memory
    parallelism=4       # 4 parallel threads
)

# Hash a password
hash = ph.hash("my_password")
# $argon2id$v=19$m=65536,t=3,p=4$...

# Verify a password
try:
    ph.verify(hash, "my_password")
    print("Password is correct!")
except:
    print("Invalid password")

6. File Integrity Verification

Hash functions let you verify that files haven't been modified or corrupted during download or transfer.

How It Works:

1. Developer calculates hash of original file
2. Hash is published alongside the download
3. User downloads file and calculates its hash
4. User compares calculated hash with published hash
5. Match = file is authentic and unmodified

Command Line Examples:

# Windows (PowerShell)
Get-FileHash -Algorithm SHA256 file.zip

# Linux/Mac
sha256sum file.zip

# Output: 
# e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  file.zip

Code Examples:

// Node.js - Hash a file
const crypto = require('crypto');
const fs = require('fs');

function hashFile(filePath, algorithm = 'sha256') {
    return new Promise((resolve, reject) => {
        const hash = crypto.createHash(algorithm);
        const stream = fs.createReadStream(filePath);
        
        stream.on('data', data => hash.update(data));
        stream.on('end', () => resolve(hash.digest('hex')));
        stream.on('error', reject);
    });
}

// Python
import hashlib

def hash_file(filepath, algorithm='sha256'):
    hash_obj = hashlib.new(algorithm)
    with open(filepath, 'rb') as f:
        for chunk in iter(lambda: f.read(8192), b''):
            hash_obj.update(chunk)
    return hash_obj.hexdigest()

7. Salting and Peppering

Why Salting Matters:

// Without salt - identical passwords have identical hashes
hash("password123") → 5f4dcc3b5aa765d61d8327deb882cf99
hash("password123") → 5f4dcc3b5aa765d61d8327deb882cf99  // Same!

// With salt - identical passwords have different hashes
hash("password123" + "randomsalt1") → a1b2c3d4e5f6...
hash("password123" + "randomsalt2") → x7y8z9w0v1u2...  // Different!

Rainbow Table Attack Prevention:

A rainbow table is a precomputed database of hash → password mappings. Without salt, attackers can look up hashes instantly. With unique salts, attackers would need a separate rainbow table for every possible salt – computationally infeasible.

8. Implementation Examples

JavaScript (Browser & Node.js)

// Browser - using Web Crypto API
async function sha256(message) {
    const encoder = new TextEncoder();
    const data = encoder.encode(message);
    const hash = await crypto.subtle.digest('SHA-256', data);
    return Array.from(new Uint8Array(hash))
        .map(b => b.toString(16).padStart(2, '0'))
        .join('');
}

// Node.js
const crypto = require('crypto');

function hash(algorithm, data) {
    return crypto.createHash(algorithm).update(data).digest('hex');
}

console.log(hash('md5', 'Hello'));     // 8b1a9953c4611296a827abf8c47804d7
console.log(hash('sha256', 'Hello'));  // 185f8db32271fe25f561a6fc938b2e264...

// HMAC (for message authentication)
function hmac(algorithm, key, data) {
    return crypto.createHmac(algorithm, key).update(data).digest('hex');
}

Python

import hashlib

# Basic hashing
def hash_string(algorithm: str, data: str) -> str:
    return hashlib.new(algorithm, data.encode()).hexdigest()

print(hash_string('md5', 'Hello'))     # 8b1a9953c4611296a827abf8c47804d7
print(hash_string('sha256', 'Hello'))  # 185f8db32271fe25f561a6fc938b2e264...

# HMAC
import hmac

def create_hmac(key: str, message: str, algorithm='sha256') -> str:
    return hmac.new(
        key.encode(),
        message.encode(),
        algorithm
    ).hexdigest()

# Hash file
def hash_file(filepath: str, algorithm='sha256') -> str:
    h = hashlib.new(algorithm)
    with open(filepath, 'rb') as f:
        for chunk in iter(lambda: f.read(8192), b''):
            h.update(chunk)
    return h.hexdigest()

Java

import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;

public class HashExample {
    public static String hash(String algorithm, String data) throws Exception {
        MessageDigest digest = MessageDigest.getInstance(algorithm);
        byte[] hashBytes = digest.digest(data.getBytes(StandardCharsets.UTF_8));
        
        StringBuilder hex = new StringBuilder();
        for (byte b : hashBytes) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }
    
    public static void main(String[] args) throws Exception {
        System.out.println(hash("MD5", "Hello"));
        System.out.println(hash("SHA-256", "Hello"));
    }
}

PHP

<?php
// Basic hashing
echo hash('md5', 'Hello');     // 8b1a9953c4611296a827abf8c47804d7
echo hash('sha256', 'Hello');  // 185f8db32271fe25f561a6fc938b2e264...

// Password hashing (use this for passwords!)
$hash = password_hash('my_password', PASSWORD_BCRYPT, ['cost' => 12]);
// Or better:
$hash = password_hash('my_password', PASSWORD_ARGON2ID);

// Verify password
if (password_verify('my_password', $hash)) {
    echo "Password is correct!";
}

// Hash file
echo hash_file('sha256', 'path/to/file.zip');
?>

9. Security Considerations

10. Frequently Asked Questions