What Is a Hash Function?

What a hash function does

A hash function takes any input — a word, a file, an entire database — and produces a fixed-length string called a hash (or digest). Feed in the same input and you always get the same hash. Change even one character and the hash changes completely.

This property — tiny input changes causing wildly different outputs — is called the avalanche effect. It is fundamental to why hash functions are useful.

Hash functions are one-way

You cannot reverse a hash back to the original input. This is by design. A good hash function is a mathematical one-way street — given the output, there is no efficient algorithm to find the input that produced it.

This makes them useful for verifying data without storing the data itself. For example, a website can store the hash of your password instead of the password — when you log in, it hashes what you type and compares it to the stored hash.

Common hash algorithms compared

What are hash functions used for?

• File integrity — software distributors publish SHA-256 hashes of download files. You hash the file you downloaded and compare — if they match, the file is untampered.
• Password storage — websites store hashes of passwords, not the passwords themselves. A breach exposes hashes, not plain text. (Note: use bcrypt/Argon2 for passwords, not raw SHA-256 — see how passwords are hashed.)
• Digital signatures — signing a document hashes it first, then encrypts the hash. Verifying the signature re-hashes the document and compares.
• Data deduplication — hash a file to get a unique fingerprint. Two files with the same hash are identical, so you can safely store only one copy.
• Blockchain — each block contains the hash of the previous block, creating a tamper-evident chain. Changing any block invalidates every block after it.

Collisions — why MD5 is broken

A collision is when two different inputs produce the same hash. For a secure hash function, finding a collision should be computationally infeasible. MD5 and SHA-1 have been broken in this sense — researchers can craft two different files that produce the same hash. This makes them unsuitable for security purposes.

SHA-256 has no known practical collisions. Its 256-bit output space is so large that even with all the world's computing power it would take longer than the age of the universe to find one by brute force.

Related guides

• SHA-256 Explained — How It Works and When to Use It →
• How Passwords Are Hashed — bcrypt, SHA-256, and Why It Matters →