What Is Hashing in Cyber Security? Hash Functions, Salting and Password Storage

Hashing Explained Simply

Imagine a machine that takes any document, whether one line or a thousand pages, and prints a short code of fixed length. The same document always produces the same code, but changing even one comma produces a totally different code, and it is practically impossible to rebuild the document from the code. That machine is a hash function and the code is a hash, digest or fingerprint.

In cyber security hashing is used to prove that data has not changed, to store passwords without keeping the real password, to build digital signatures and to find known malicious files by their fingerprint.

Properties of a Good Hash Function

• Deterministic: the same input always gives the same hash.
• Fast to compute for general hashing (but deliberately slow for password hashing).
• Pre-image resistance: you cannot find the input from the hash.
• Second pre-image resistance: given one input it is hard to find another with the same hash.
• Collision resistance: it is hard to find any two different inputs with the same hash.
• Avalanche effect: a tiny change in input drastically changes the output.

Common Hash Algorithms

Hashing vs Encryption

Beginners often confuse these. Encryption is designed to be reversed by someone with the right key, because the goal is to hide data and read it again later. Hashing is one-way, because the goal is to compare or verify rather than to recover. You encrypt a message you want to send securely; you hash a password you want to store without being able to read it back. Both belong to cryptography.

How Websites Should Store Passwords

A well-designed site never stores your actual password. When you register, it generates a random salt, combines it with your password, runs a slow password-hashing function such as bcrypt or Argon2 and stores the salt and hash. At login it repeats the process and compares the results. Salting ensures two users with the same password get different hashes and defeats precomputed rainbow tables. A slow algorithm means attackers who steal the database must spend large effort per guess.

Poor practice includes storing plain text, using a single fast hash like unsalted MD5 or inventing your own scheme. When breaches expose such databases, millions of passwords are cracked within hours.

Hashing for File Integrity

When you download software, the publisher often provides a SHA-256 checksum. After downloading you compute the hash locally and compare. If they match, the file is intact; if they differ, the file is corrupted or tampered with. Forensic investigators use the same idea: they hash disk images before and after copying to prove that evidence has not changed. Security tools also compare file hashes against databases of known malware, though attackers change files slightly to defeat this, which is why behaviour-based detection is also needed.

1. On Linux or macOS, run sha256sum filename to compute a SHA-256 hash.
2. On Windows PowerShell, run Get-FileHash filename -Algorithm SHA256.
3. Compare the output with the value published by the vendor.

Attacks on Hashes

• Brute force: trying all possible inputs; stopped by length and slowness.
• Dictionary attack: trying common passwords and variants.
• Rainbow tables: precomputed hash lookups; defeated by salting.
• Collision attacks: creating two inputs with the same hash; why MD5 and SHA-1 are unsafe for signatures.
• Pass-the-hash: reusing captured Windows password hashes to authenticate without cracking them; mitigated by credential protection and least privilege.

In a controlled lab, learners in our ethical hacking course crack sample hashes with Hashcat to see why long, unique passwords and slow hashing matter.

Common Misconceptions About Hashing

• “Hashed passwords can be decrypted.” They are cracked by guessing, not decrypted.
• “SHA-256 is enough for passwords.” It is too fast; use bcrypt, scrypt or Argon2.
• “Same file, different hash.” Identical input always gives identical output.
• “Hashes are always unique.” Collisions exist theoretically but are infeasible for strong algorithms.
• “Hashing hides the message.” It is for verification, not secrecy.

Hands-On Exercise: Watch the Avalanche Effect

Create a text file with the sentence “Cyber security is fun”. Compute its SHA-256 hash. Change “fun” to “Fun” and compute again. Compare the two long hex strings and note how completely they differ. Next, compute MD5 for both and observe the shorter output. Finally, use a Python script with the hashlib library to hash a list of ten words and store results in a dictionary. This demonstrates determinism, avalanche effect and algorithm differences within minutes.

Self-Test

1. Is hashing reversible? (No.)
2. What does a salt do? (Makes each password hash unique.)
3. Which algorithms suit password storage? (bcrypt, scrypt, Argon2.)
4. Why is MD5 unsafe for signatures? (Collisions can be created.)
5. How do you verify a downloaded file? (Compare its hash with the publisher’s.)

Illustrative Scenario: Verifying a Download

A system administrator downloads a server tool from a mirror site. The vendor’s website lists a SHA-256 value. He computes the hash locally and finds that it differs. Investigation reveals that the mirror was compromised and the installer modified. Because he checked, the tampered file never reached production. A thirty-second habit prevented a serious supply-chain incident.

Practical Tips for Using Hashes

• Download hash values from the vendor’s official HTTPS site, not from the same mirror as the file.
• Prefer SHA-256 or stronger for integrity checks.
• For passwords always use salted, slow algorithms.
• Log hash values of important files for forensic comparison.
• Remember that a matching hash only proves identity with the reference you trust.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

How do you respond to a ransomware infection?

Isolate affected systems, preserve evidence, identify the strain and entry point, restore from clean backups, reset credentials and report to relevant authorities such as CERT-In. Paying should not be the default plan.

What is zero trust?

Zero trust assumes no user or device is trusted by default; every access request is verified using identity, device health and context, and access is limited to what is necessary.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses one shared key and is fast, for bulk data; asymmetric uses a public-private key pair and solves key distribution and enables digital signatures. TLS uses asymmetric methods to agree a symmetric session key.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Credential stuffing: Using username and password pairs leaked from one site to try to log in to others, relying on password reuse.
• SIEM: A platform that collects logs from many systems, correlates events and raises alerts for analysts to investigate.
• Zero-day: A vulnerability that the vendor does not yet know about or has not yet patched, making it especially dangerous.
• 3-2-1 backup: Keep three copies of data on two different media with one copy offline or off-site, so that ransomware cannot destroy every copy.
• Penetration test: An authorised simulated attack that tries to exploit weaknesses and proves their business impact.
• Botnet: A network of infected devices controlled remotely by an attacker, often used for DDoS or spam.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Cyber Security Course, CompTIA Security+ Training and Ethical Hacking Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is Cryptography in Cyber Security? Encryption, Hashing and Digital Signatures • What Is the CIA Triad in Cyber Security? Confidentiality, Integrity, Availability • What Is SQL Injection in Cyber Security? Types, Example and Prevention.