What is hashing?
Hashing is a cryptographic one-way function: an algorithm takes arbitrary data (a password, a file, an entire disk image) and computes a fixed-length fingerprint called a hash or a checksum. Three properties make it useful:
- Deterministic: the same input always produces exactly the same hash.
- Avalanche effect: change one bit of the input, and the hash changes completely.
- One-way: the hash cannot be computed backwards to the original data, and in practice it must be impossible to find two different inputs with the same hash (collision resistance).
The standard algorithms today are SHA-256 and the rest of the SHA-2/SHA-3 family. Note the difference from encryption: encrypted data can be unlocked again with the key. A hash can never be "unlocked".
Passwords: why they are never stored in plain text
A properly built system never stores your password. It stores a hash of it. At login, the entered password is hashed and the result compared. If the database is stolen, the attacker is left with fingerprints instead of passwords.
But ordinary hash algorithms are too fast for passwords: an attacker can guess billions of combinations per second. That is why dedicated, deliberately slow algorithms such as bcrypt and Argon2 are used, combined with a unique salt per user, so identical passwords do not produce identical hashes. OWASP maintains the recommendations in this area. As a business, your most important contribution is still MFA, so a leaked password never stands alone.
Integrity: fingerprints on files and systems
Hashing is also the practical way to detect tampering: vendors publish hashes of their downloads, so you can verify that a file is genuine and unaltered. Backup systems, EDR tools and forensics use hashes to recognise known files and known malware. And in a digital signature, it is precisely the hash of the document that is signed: if the hash does not match, the document has been altered.
When hash algorithms die: MD5 and SHA-1
Hash algorithms do not last forever. MD5 was broken in 2004, and SHA-1 followed. For both, collisions can be constructed today: two different files with the same hash. That makes them unusable for signatures and certificates, where collision resistance is precisely what carries the trust. If you come across systems that still use them for security, that is a finding that needs remediating, typically the kind of thing a penetration test or a security review catches.
How MI Support IT can help
We make sure hashing is used correctly in your environment: modern algorithms in certificates and systems, correct password storage in the solutions you run yourselves, and integrity checking in backup and operations, as part of your overall IT security and the security reviews we carry out. Contact us if you would like your setup looked over.