What a hash function is, and is not

A hash function takes any amount of data and returns a short, fixed-size fingerprint. The same input always gives the same fingerprint, a different input gives a different one (with overwhelming probability), and the fingerprint reveals nothing usable about the input. That's the whole idea, and it's the quiet workhorse of cryptography. File checksums, password storage, digital signatures, message authentication and key derivation are all built on it. A hash function is not encryption. Nothing is hidden in a way that can be unhidden, because the fingerprint doesn't contain the data.

The three properties

For a hash function H that outputs n bits, cryptographers ask for three kinds of resistance, from weakest to strongest.

• Preimage resistance (one-way): given a fingerprint y, it should be infeasible to find any message m with H(m) = y. The generic cost is about 2ⁿ tries.
• Second-preimage resistance: given a message m, it should be infeasible to find a different message m′ with the same fingerprint. Also about 2ⁿ. This is what protects a document whose hash you trust.
• Collision resistance: it should be infeasible to find any two different messages with the same fingerprint. The attacker chooses both, so the birthday effect makes this far cheaper, at about 2^n/2 tries.

A hash that resists collisions generally resists second preimages too, but not the other way round. When a hash "is broken", it's nearly always the collision property that fails first.

The birthday bound, computed

Why is finding collisions so much cheaper? With k values there are about k²/2 pairs that could collide. The chance that some pair among k random n-bit hashes collides is about 1 − e^−k2/2n+1, which reaches one half at k ≈ 1.1774 × 2^n/2. From the script scripts/examples/sha256-worked.mjs:

A 32-bit fingerprint collides after fewer than a hundred thousand inputs, which is why a short hash is only a checksum. At 2¹²⁸ a collision is out of reach of any computer that could ever be built. That's also why hashes used for signatures are at least 256 bits: a collision search at 2¹²⁸ matches the cost of attacking 128-bit symmetric security.

What "broken" means: MD5 and SHA-1

MD5 (Ronald Rivest, 1991; RFC 1321 in 1992) outputs 128 bits. Its compression function was attacked in 1996, and in August 2004 Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced collisions for the full function. By December 2008 researchers had used MD5 collisions to create a rogue certificate authority certificate, and the CMU Software Engineering Institute advised that MD5 was "cryptographically broken and unsuitable for further use". In 2012 Microsoft reported that the Flame malware had forged a code-signing certificate with an MD5 collision.

SHA-1 (160 bits, 1995) took longer. On 23 February 2017 Marc Stevens, Pierre Karpman and colleagues at CWI and Google published SHAttered, the first collision for the full SHA-1: two different PDF files with the same hash, found with about nine quintillion SHA-1 computations, roughly 6,500 CPU-years and 110 GPU-years. In January 2020 Gaëtan Leurent and Thomas Peyrin showed a chosen-prefix collision, where the attacker picks the start of both messages, for about $45,000 of computing time. NIST retired SHA-1 on 15 December 2022, with a phase-out by the end of 2030.

Both were broken for collisions, not preimages. An MD5 or SHA-1 fingerprint of a file you already hold still identifies it against accidental corruption, but it no longer proves nobody crafted two files to match. Use SHA-256 or better for anything that matters. The hash identifier tells you which family a hash belongs to from its length and form, and the hash generator computes all of them.

How hash functions are built

Most of the classical ones, MD5, SHA-1 and the SHA-2 family including SHA-256, use the Merkle–Damgård construction. It pads the message, cuts it into blocks, and feeds them one at a time into a compression function that updates a fixed-size state. The last state is the hash. It's simple and fast, and it has one structural consequence: the output is the whole internal state, so an attacker who knows H(m) can keep hashing from it. That's the length-extension property, and it's why HMAC exists. SHA-3 (the Keccak design, standardized in FIPS 202) uses a different structure, a sponge, that lacks it. BLAKE2 and BLAKE3 are fast designs that avoid it too.

What a hash is used for

• Integrity. Publish the hash of a download so people can check what they received (file checksum tool). The hash has to come from a source the attacker can't change, or it proves little.
• Commitments. Publish the hash of a secret now and reveal the secret later. It proves you knew it then, without giving it away.
• Signatures. Public-key signatures such as RSA sign the hash of a message and not the message itself, so the hash has to resist collisions.
• Keyed use. With a secret key, hashing makes a MAC (HMAC) or the engine of a key-derivation function (PBKDF2).
• Not for passwords on their own. A fast hash lets an attacker test billions of guesses a second. Passwords need a deliberately slow function (password hashing).

Hashes aren't encryption

A hash has no key and no way back, so someone who says "I encrypted it with MD5" is describing something else. The hash of a short or guessable input isn't hidden. An attacker just hashes guesses until one matches, which is how most leaked password hashes get cracked. The hash of "password" is as public as the word. If you want a secret hidden so it can be recovered, you need encryption, which takes a key and has an inverse.

Try them

The hash generator computes MD5, SHA-1, SHA-2, SHA-3 and BLAKE3 for text or files in your browser, and the hash compare tool lines up two results. The SHA-256 explorer shows every step of one hash and flips a bit to show the avalanche. Change one letter of the sentence "The quick brown fox jumps over the lazy dog" and about half of the output bits change, in every algorithm (for example 112 of 256 bits for SHA-256 after changing the first letter of "abc").

How cipher.ink uses this

The hash does its work in the background. Every passphrase message runs SHA-256 inside PBKDF2-HMAC-SHA256 for 600,000 rounds. The server stores the SHA-256 of each receipt token instead of the token. And the 128-bit tag that AES-GCM attaches is a different construction (a polynomial hash over a field), not a general-purpose hash. The sealing and opening code uses SHA-256 and nothing weaker, and MD5 and SHA-1 appear on this site only as tools that compute them.