Hashing in Practice

Password Storage

Hashing is essential for keeping passwords safe in modern systems. When you create an account, you do not want your actual password stored in the database. Instead, the system uses a hash function to convert your password into a unique, fixed-length string called a hash.

How Password Hashing Works

• You enter your password during sign-up;
• The system runs your password through a hash function, creating a hashed value;
• Only the hashed value is saved in the database;
• When you log in, your entered password is hashed again and compared to the stored hash; if they match, access is granted.

Practical Example

Suppose your password is "SuperSecret123". The system uses a hash function like SHA-256:

• Your password: SuperSecret123
• Hashed value: acb9c4a7f8e2d6f3b1e9c8a0a2e1d5c7b8f9a6e3f2d1c4b3a8e9d7c6b5f4e3d2

Even if someone gains access to the database, they only see the hash, not your real password. Good systems also use a salt—a random value added to your password before hashing—to make each hash unique, even for users with the same password.

Data Verification

Hashing helps you check if data has been changed or tampered with. When you receive a file, you can use a hash function to create a unique hash value from its contents. If even a single character in the file changes, the hash value will be completely different.

Here is how you can use hashing for data verification:

• Download a file from a trusted website;
• The website provides the original hash value (sometimes called a checksum) for the file;
• Use a hash tool to generate the hash value of your downloaded file;
• Compare your hash value to the one from the website. If they match, the file is authentic; if not, the file may have been altered.

Example:

Suppose you download a software installer and the website says the file’s SHA-256 hash is:

4d186321c1a7f0f354b297e8914ab240

After downloading, you use a hash calculator and get the same hash value. This means the file is exactly what the website intended, with no tampering during download. If the hash values do not match, you should not trust the file.