Hashing (and salting)
hash function · hash · digest · salt · salting · SHA-256 · Argon2id · bcrypt
A calculation that turns any piece of data into a fixed-size fingerprint that cannot practically be reversed, and that changes completely if the data changes even slightly.
In practice
Hashing is used to check a file’s integrity (SHA-256), to prepare a digital signature and to store passwords without keeping them in plain text. For passwords, a salt is added, a random value unique to each account, so that two identical passwords produce different hashes and precomputed tables become useless. Above all, a deliberately slow function designed for the job is chosen (Argon2id, scrypt, bcrypt or PBKDF2), which slows down mass guessing if the database is stolen. MD5 and SHA-1 are broken (collisions can be produced) and have no place in any security use.
Fictional case: two websites have their user databases stolen. The first stored passwords as unsalted MD5: most are recovered within hours. The second used Argon2id with a salt per account: each password has to be attacked separately, at a prohibitive cost.
How to protect yourself
- Store passwords with Argon2id, scrypt, bcrypt or PBKDF2, and a unique salt per account.
- Ban MD5 and SHA-1 from every security use.
- Check the hash of downloaded software when the vendor publishes it.
