The Importance of Cryptographic Hashes in Web Apps

Cryptographic hashing is one of the foundational building blocks of secure software, yet it is frequently confused with encryption. They are not the same thing. This article explains what a hash function is, why it matters, and how to use hashes correctly for integrity checks and password storage. You can experiment with real hashes using our Hash Generator.

What is a hash function?

A cryptographic hash function takes input of any size and produces a fixed-size output (the digest). Good hash functions have three crucial properties:

• Deterministic: the same input always yields the same digest.
• One-way: you cannot reverse a digest back into the input.
• Collision-resistant: it is infeasible to find two inputs with the same digest.

SHA-256("hello") =
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Hashing vs encryption

Encryption is reversible — with the key, you recover the original data. Hashing is a one-way street: there is no key and no way to "decrypt" a digest. That is exactly why hashing is the right tool for passwords, where you never want to recover the original.

Use case 1: data integrity

When you download a file, the publisher often lists its SHA-256 hash. Hashing your downloaded copy and comparing the digests proves the file was not corrupted or tampered with in transit. The same idea underpins Git commit IDs, content-addressed storage, and blockchain.

Use case 2: password storage

Passwords must never be stored in plain text. Instead, store a hash. But a plain SHA-256 of a password is notenough — attackers use precomputed "rainbow tables" and fast GPUs. Two techniques fix this:

• Salting: add a unique random value to each password before hashing so identical passwords produce different digests.
• Slow hashing: use a deliberately expensive algorithm like bcrypt, scrypt, or Argon2 that is costly to brute-force.

Which algorithm should I use?

• MD5 / SHA-1: broken for security — only for non-security checksums.
• SHA-256 / SHA-512: excellent for integrity and signatures.
• bcrypt / Argon2: the correct choice for password storage.

A quick example in the browser

async function sha256(text) {
  const data = new TextEncoder().encode(text);
  const buf = await crypto.subtle.digest("SHA-256", data);
  return [...new Uint8Array(buf)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

Frequently asked questions

Can two different inputs ever produce the same hash?

In theory yes — that is a collision — but for a strong function like SHA-256 it is computationally infeasible to find one. MD5 and SHA-1 have practical collisions, which is why they are deprecated for security.

Why not just use SHA-256 for passwords?

SHA-256 is too fast: modern GPUs can compute billions per second, making brute force easy. Password hashing needs an intentionally slow, salted algorithm like bcrypt or Argon2.