Hash function

What it means

A hash function is a mathematical function that turns any data into a short fingerprint of fixed length, called a hash. Even the smallest change to the data, such as one comma in a contract, changes the result completely, and the original content cannot be recovered from the hash.

A good hash function such as SHA-256 is collision-resistant, meaning it is practically impossible to find two different documents with the same hash. Older functions such as MD5 or SHA-1 are no longer considered secure because collisions have been produced for them.

Hashes are used to verify that a document is unchanged, in electronic signatures, timestamps, blockchain and for storing passwords securely. They are an invisible but fundamental building block of digital trust.

How it works in practice

In an electronic signature, it is not the whole document that is signed but its hash, encrypted with the private key. The recipient calculates the hash of the received document and compares it with the signed one; if they differ, the document was altered after signing.

When archiving electronic documents and records, hashes are used to prove integrity. If a document is linked to a hash and a qualified timestamp, it can be shown years later that the document existed in that form on a given date.

Passwords should never be stored in readable form but as a hash with an added random value, using slow algorithms designed for passwords. If the database leaks, the attacker does not obtain the passwords directly and cracking them is very difficult.

What to watch out for

A hash is not encryption. Encrypted data can be decrypted with a key, while original data cannot be obtained from a hash. For short or predictable data such as national ID numbers, however, an attacker can guess the hash by trying every possibility.

If a system stores passwords with a simple fast hash and no random value, weak passwords can be cracked quickly after a breach. A password policy, a password manager and, in development, proven libraries instead of home-made solutions are therefore important.