Hashes, integrity and fingerprint comparison: what a hash can really prove

A cryptographic hash maps arbitrary input to a fixed-size fingerprint. It is designed to be one-way and deterministic: the same input gives the same digest, while a tiny change should produce a very different result.

Hashing is not encryption or encoding

Encryption is reversible with a key. Encoding changes representation and is meant to be reversible. Hashing is not intended to recover the original input. This distinction matters when choosing a tool or describing a security property.

Modern algorithms and legacy hashes

SHA-256 and SHA-3 are common modern choices for integrity workflows. MD5 and SHA-1 remain visible in legacy ecosystems but have known collision weaknesses and should not be chosen for collision-resistant security designs.

A matching hash proves equality, not origin

If a trusted source publishes a fingerprint through a trusted channel, comparing your file with it can detect accidental or malicious modification. But an attacker able to replace both the file and the displayed hash can fool a plain comparison. Authenticity may require a MAC or digital signature.

Use the hash generator and hash comparison tool for local checks. For browser-loaded third-party resources, SRI applies the same integrity idea in HTML.

Passwords need specialized hashing

Fast general-purpose hashes are intentionally efficient, which makes large-scale password guessing efficient too. Password storage therefore uses dedicated password-hashing functions with salts and tunable cost. See the password guide for that separate problem.

For a broader comparison with encryption, HMAC and PBKDF2, continue with encryption, hashing and HMAC.