Hash functions
The conceptHow a 4 GB download is checked against 64 characters
A hash function turns any input, from one word to a whole film, into a short fixed-length fingerprint called a digest. SHA-256, the most widely used one, always outputs 256 bits, written as 64 hexadecimal characters.
Hash "hello" with SHA-256 and you always get 2cf24dba…9824, on any computer. Add a full stop and about half the output bits flip, so the two digests look unrelated. This is called the avalanche effect.
A cryptographic hash must also be one-way: given a digest, the only way to find a matching input is guessing. And finding two inputs with the same digest, called a collision, must be practically impossible.
What it’s forEstimates how much work it takes to run an n-bit hash backwards by guessing.
expected guesses ≈ 2ⁿ
- n
- the number of bits in the digest, e.g. 256 for SHA-256
- 2ⁿ
- how many different digests exist; each guess hits the target with chance 1 in 2ⁿ
What it givesThe average number of random inputs an attacker must hash before one matches a given digest.
- Toy 8-bit hash: 2⁸ = 256 guesses, done in a blink.
- 16-bit hash: 2¹⁶ = 65,536 guesses, still trivial for a laptop.
- SHA-256: 2²⁵⁶ ≈ 1.2 × 10⁷⁷ guesses, far beyond all computers ever built.