A hash function takes an input of any size and produces a fixed-size output called a digest or hash. The same input always produces the same hash. Even a tiny change to the input, flipping a single bit, produces a completely different hash. This property is called the avalanche effect.
Cryptographic hash functions add additional requirements: it must be computationally infeasible to reverse the hash back to the original input (preimage resistance), to find two different inputs that produce the same hash (collision resistance), or to find a second input that matches a given input's hash (second preimage resistance).
MD5 produces a 128-bit hash. It was once widely used but is now considered broken for security purposes. Collision attacks against MD5 have been practical since 2004. Do not use MD5 for anything security-related. It is still acceptable for non-security checksums, like verifying file downloads.
SHA-1 produces a 160-bit hash. Google demonstrated a practical collision attack (SHAttered) in 2017. SHA-1 is deprecated for digital signatures and certificates. Major browsers and CAs stopped trusting SHA-1 certificates years ago.
SHA-256 is part of the SHA-2 family and produces a 256-bit hash. It is currently the standard for most security applications, including TLS certificates, code signing, and blockchain. SHA-256 has no known practical vulnerabilities.
SHA-3 is the newest standard, based on a completely different internal structure (Keccak) from SHA-2. It provides an alternative if SHA-2 is ever compromised, though SHA-2 remains secure and widely deployed.
Storing passwords in plaintext is one of the most dangerous mistakes an application can make. If the database is breached, every user's password is immediately exposed. Hashing passwords before storage means the database contains only hashes, not the original passwords.
However, using a general-purpose hash like SHA-256 for passwords is not enough. Attackers can precompute hashes for billions of common passwords (rainbow tables) and compare them against stolen hashes. Two countermeasures address this.
Salting adds a unique random value to each password before hashing. Even if two users have the same password, their hashes will differ because their salts differ. Salts are stored alongside the hash, so they do not need to be secret.
Key stretching makes the hash function deliberately slow by running it thousands of times. Purpose-built password hashing algorithms like bcrypt, scrypt, and Argon2 implement this. Argon2 won the Password Hashing Competition in 2015 and is the current best choice. It is resistant to both GPU-based cracking and memory-based attacks.
When you download software, the publisher often provides a SHA-256 hash of the file. After downloading, you compute the hash of your local copy and compare. If they match, the file was not tampered with during transit.
File integrity monitoring (FIM) tools use this same principle. They compute hashes of critical system files, store them in a baseline, and alert you if any hash changes unexpectedly. OSSEC, Tripwire, and Wazuh all provide FIM capabilities.
Digital signatures combine hashing with asymmetric cryptography. The signer hashes the document, then encrypts the hash with their private key. The recipient decrypts the hash with the signer's public key and compares it to their own hash of the document. If they match, the document has not been altered and came from the claimed signer.