How hash works
A cryptographic hash function such as SHA-256 takes any amount of input and produces a short digest. The function is one-way, meaning the original data cannot practically be recovered from the digest, and it should make collisions, where two inputs give the same hash, computationally infeasible.
Hashes are used to check downloads, detect file tampering, support digital signatures and identify known malware samples. For passwords, systems store a salted hash produced by a deliberately slow algorithm so stolen databases are hard to reverse. Common functions include SHA-256 and SHA-3 for integrity, while HMAC adds a secret key so receivers can confirm both integrity and who produced the data.
Why it matters for Canadian organizations
Weak password storage turns a breach into a credential crisis. If passwords are stored in plain text or with fast, unsalted hashes such as MD5, attackers can recover many of them quickly and reuse them elsewhere.
Hashes also matter in investigations. Security teams share file hashes as indicators of compromise, and forensic examiners use them to show that evidence has not changed, which supports incident response and any later legal or regulatory review. Threat researchers identify malware by file hash, but changing a single byte changes the hash, so attackers can evade hash-only blocklists and defenders also need behavioural detection.
How to implement it
For passwords, use purpose-built algorithms such as Argon2, bcrypt or scrypt with unique salts and appropriate cost settings. Do not use MD5 or SHA-1 for security purposes.
For integrity, use SHA-256 or stronger and compare published hashes when downloading software. Remember that a plain hash proves integrity, not origin; use digital signatures or message authentication codes when authenticity matters. Salting means adding unique random data to each password before hashing, which stops attackers from reusing precomputed tables across many accounts at once.
Frequently asked questions
Is hashing the same as encryption?
No. Encryption is reversible with the right key, so data can be recovered. Hashing is one-way, designed so the original input cannot practically be derived from the output. Encryption protects confidentiality, while hashing verifies integrity or stores secrets like passwords.
Can a hash be reversed?
Not directly. Attackers instead guess inputs, hash them and compare, using wordlists, rainbow tables or brute force. Strong passwords, salts and slow hashing algorithms make that guessing impractical, while weak ones fall quickly.
What is a hash collision?
A collision occurs when two different inputs produce the same hash. Secure algorithms make this practically impossible, but older ones such as MD5 and SHA-1 have known collision attacks, which is why they should not be used where security matters.
Related service: Cyber defense