What Is Hashing?

Hashing is a process that uses a mathematical algorithm to transform data into a fixed-length value called a hash, hash value, or digest. In cybersecurity, hashing is commonly used to verify data integrity, protect passwords, identify files, and detect whether information has been changed.

Unlike encryption, cryptographic hashing is designed to be one-way. The original data should not be practically recoverable from the hash value alone.

Even a small change to the original input should produce a significantly different hash, making hashing useful for determining whether files, messages, passwords, or other information have been altered.

Key Takeaways

• Hashing is a cryptographic process that converts data into a fixed-length value called a hash or digest, helping organizations verify data integrity, protect passwords, and identify potential security threats.
• Hashing and encryption serve different purposes. Cryptographic hashing is designed to be one-way, while encryption allows authorized users to recover the original information using the appropriate decryption key.
• Common hashing algorithms include SHA-256, SHA-3, MD5, and SHA-1. Modern algorithms like SHA-256 provide stronger cryptographic security, while older algorithms such as MD5 and SHA-1 are no longer recommended for many security applications.
• Hashing alone cannot detect or prevent every cyberattack. Organizations should combine hashing with threat detection, network visibility, and breach containment to identify suspicious activity, limit lateral movement, and reduce the impact of security breaches.

How Does Hashing Work?

A hash function takes an input and processes it through a mathematical algorithm to produce a fixed-length output.

The basic process looks like this:

Input → Hash Function → Hash Value

The input can be almost anything, including a password, document, application, message, or other piece of digital information.

Regardless of the size of the input, a given hash algorithm produces an output of a defined length. The same input processed by the same algorithm should produce the same hash value.

If the input changes, even slightly, the resulting hash should change significantly.

What Is a Hash Function?

A hash function is the algorithm used to convert input data into a hash value.

Cryptographic hash functions are designed with security properties that make them useful for protecting and verifying information.

A strong cryptographic hash function should make it computationally impractical to:

• Determine the original input from the hash
• Find two different inputs that produce the same hash
• Predict how changing an input will affect the resulting hash

These properties allow security systems to use hashes without necessarily storing or transmitting the original sensitive information.

What Is a Hash Value?

A hash value is the output produced by a hash function. It is sometimes called a hash, digest, message digest, or digital fingerprint. Because the same input should produce the same output when processed with the same algorithm, systems can compare hash values to determine whether information has changed.

For example, a software provider might publish a cryptographic hash for a downloadable file. After downloading it, a user or system can calculate the file's hash and compare it with the published value. If the values differ, the file may have been modified or corrupted.

What Is Hashing Used for in Cybersecurity?

Hashing supports several important cybersecurity functions.

Common uses include:

• Protecting stored passwords
• Verifying file integrity
• Detecting unauthorized changes
• Supporting digital signatures
• Identifying known malware or suspicious files
• Verifying downloaded software
• Comparing data without exposing the original information
• Supporting authentication systems

Hashing is particularly useful when a system needs to verify information without storing the original value in a directly readable form. It can also be used alongside other data-protection techniques, such as tokenization, which replaces sensitive information with a non-sensitive token to help reduce exposure of the original data.

‍

How Is Hashing Used to Protect Passwords?

Secure systems generally should not store user passwords as readable plaintext.

Instead, when a user creates a password, the system can process it using a password-hashing function and store the resulting hash.

When the user logs in, the password they enter is processed again. The system compares the resulting value with the stored password hash. If they match, the system can verify the password without needing to store the original password itself.

Modern password storage should use purpose-built password-hashing algorithms and additional protections such as salting rather than relying on fast general-purpose hash functions alone.

What Is a Salt in Password Hashing?

A salt is a unique random value added to a password before it is hashed.

Salting helps prevent identical passwords from automatically producing identical stored hashes. This makes certain attacks against large collections of password hashes more difficult.

For example, if two users choose the same password but each password is combined with a different salt, the resulting stored values should be different.

Salts do not need to be secret, but they should be unique and generated appropriately.

What Is the Difference Between Hashing and Encryption?

Hashing and encryption both transform data, but they have different purposes.

Encryption is designed to protect confidentiality while allowing authorized users to recover the original information. Encrypted data can be decrypted with the appropriate cryptographic key.

For a detailed breakdown of what encryption is, check out this full guide to encryption

Hashing is generally designed to be one-way. The original information is not intended to be recovered from the resulting hash.

Encryption is appropriate when protected information needs to be accessed again. Hashing is useful when a system needs to verify information, such as a password or file, without recovering the original value from the hash.

What Is the Difference Between Hashing and Encoding?

Hashing and encoding serve different purposes.

Hashing creates a fixed-length value and, when using a cryptographic hash function, is designed to be one-way.

Encoding changes information into another representation so that it can be transmitted, stored, or processed correctly. Encoding is designed to be reversible and does not require a secret key.

Because encoding is not intended to provide confidentiality or one-way protection, it should not be treated as a replacement for encryption or secure cryptographic hashing.

What Are Common Hashing Algorithms?

Several hashing algorithms have been developed over time.

Examples include:

• MD5: An older hash algorithm that is no longer considered secure for cryptographic purposes because practical collision attacks exist.
• SHA-1: Another older algorithm that is no longer considered secure for applications requiring collision resistance.
• SHA-2: A family of widely used cryptographic hash functions that includes SHA-256 and SHA-512.
• SHA-3: A newer family of cryptographic hash functions based on a different design from SHA-2.

For password storage, organizations should use specialized password-hashing algorithms designed to make password cracking more computationally expensive.

What Is SHA-256?

SHA-256 is a cryptographic hash function in the SHA-2 family.

It produces a 256-bit hash value regardless of the size of the original input.

SHA-256 is widely used for applications such as verifying file integrity, digital signatures, certificates, and other cryptographic processes.

However, general-purpose hash functions such as SHA-256 should not normally be used by themselves for storing passwords. Password-specific hashing algorithms are designed to provide additional resistance against password-cracking attempts.

Can Hashing Be Reversed?

Secure cryptographic hashing is designed to be one-way, meaning there is no decryption key that simply converts a hash back into its original input.

However, attackers may attempt to determine the original value by guessing possible inputs, hashing them, and comparing the results.

This is particularly relevant to passwords. Weak or commonly used passwords may still be discovered through dictionary attacks, brute-force attacks, or precomputed data.

Strong password-hashing practices, unique salts, strong passwords, and appropriate authentication controls can make these attacks more difficult.

How Is Hashing Used for File Integrity?

Hashing can help determine whether a file has changed.

A system can calculate a hash value for a known file and store or publish that value. Later, it can calculate the hash again and compare the two results.

If the hash values match, that provides strong evidence that the file has not changed. If they differ, the file has been modified or corrupted.

Security teams can use this technique to identify unexpected changes to applications, configuration files, system files, and other important resources.

What Are the Limitations of Hashing?

Hashing is an important security technique, but it does not prevent cyberattacks on its own.

Attackers may change malware to generate a new hash, compromise legitimate credentials, exploit vulnerabilities, or use tools that do not match known malicious file hashes.

A hash can help determine whether known information matches or has changed, but it does not necessarily explain what a system is doing or whether its behavior is malicious.

This is why organizations combine hashing with broader breach detection, monitoring, access controls, network visibility, segmentation, and threat intelligence.

Hashing and Breach Containment

Hashing can help security teams identify known malicious files and detect unexpected changes, but organizations also need to prepare for threats that bypass those detection methods.

If an attacker compromises an endpoint or workload, they may use legitimate tools, stolen credentials, or modified malware to avoid simple hash-based detection.

Once inside, the attacker may attempt to communicate with other systems and move laterally toward sensitive data or critical resources.

Visibility into communication across the environment can help security teams understand what compromised systems are doing and identify pathways that could allow an attack to spread.

Go Beyond Known Threats With Illumio Insights

A file hash can help you recognize a known threat. But attackers don't always use files or behaviors you've seen before.

Illumio Insights gives security teams visibility into how workloads communicate, helping uncover suspicious connections, risky pathways, and potential lateral movement that traditional indicators alone may miss.

Turn network activity into actionable intelligence and identify threats before they spread across your environment.

Discover Illumio Insights →

자주 묻는 질문

What is hashing in simple terms?

Hashing is a process that converts data into a fixed-length value using a mathematical algorithm. The resulting hash can be used to verify information without needing to expose the original data.

What is hashing used for?

Hashing is commonly used for password protection, file integrity verification, digital signatures, threat detection, authentication, and other cybersecurity functions.

Is hashing the same as encryption?

No. Encryption is designed to be reversible with the appropriate key. Cryptographic hashing is designed to be one-way, meaning the original input should not be practically recoverable from the hash alone.

How Is Hashing Used in Threat Detection?

Security teams can use file hashes as one piece of information when investigating potential threats. However, attackers can modify a file so that it produces a different hash. As a result, hash-based detection alone cannot identify every malicious file or cyberattack. Security teams need additional context, including behavior, network communication, identity information, and activity across the environment.

Can a hash be decrypted?

No. Hashing does not use a decryption process like encryption. Attackers can, however, attempt to discover the original input by guessing values and comparing their hashes.

What Is a Hash Collision?

A hash collision occurs when two different inputs produce the same hash value.

Because hash functions map a potentially enormous number of possible inputs into outputs of a fixed size, collisions are mathematically possible. This is one reason older algorithms such as MD5 and SHA-1 are no longer recommended for many security applications.

What is the difference between hashing and salting?

Hashing transforms information into a fixed-length value. Salting adds a unique random value to information, such as a password, before it is hashed to strengthen protection against certain password-cracking techniques.

Is SHA-256 encryption or hashing?

SHA-256 is a cryptographic hash function, not an encryption algorithm. It produces a 256-bit hash and is designed to be one-way.

Why are hashes useful in cybersecurity?

Hashes allow security teams and systems to verify information, identify known files, detect changes, and protect credentials without always needing to store or compare the original data directly.

‍