What it means
A cryptographic hash maps input data to a fixed-length digest. The same input and algorithm produce the same digest, while changing the input should produce a different result with overwhelming probability for a suitable algorithm. Hashing is not reversible encryption and does not make a document confidential. Comparing a file with a trusted expected digest can help detect alteration, but an attacker who can replace both the file and the expected value can defeat that comparison. Password verification requires a different design: a salted, deliberately expensive password-hashing algorithm, rather than a fast general-purpose hash alone.
The idea at a glance / Data
Same bytes, same fingerprint.
Compare an original, an exact copy, and a copy with one changed byte using SHA-256.
Synthetic text records: UTF-8, no spaces or trailing newline. Each arrow means “compute SHA-256”; only 12 of the 64 hexadecimal digest characters are drawn.
READ THE PICTURE
Compare the exact bytes
A and B contain the same bytes, so SHA-256 produces the same full digest. C changes the first amount digit from 1 to 9; its digest differs. The original stays visible for comparison.
Keep in mindA hash does not encrypt data or authenticate its origin. Different inputs can share a digest; checking integrity needs a trusted full reference digest, not this shortened display.
Read the complete example
- Compare the exact bytes. A and B contain the same bytes, so SHA-256 produces the same full digest. C changes the first amount digit from 1 to 9; its digest differs. The original stays visible for comparison. A and B each contain exactly the ten UTF-8 bytes of amount=100; C contains amount=900, changing one byte. There is no trailing newline. SHA-256 produces a 256-bit digest, represented here by 64 hexadecimal characters. A and B: e95a8448fe0cd7312b87b2f2c2157c587e74f34510f19ca7ad1ae3c38aa0c6a9. C: b6ecc9d5b0916e7066e2ce44b8b846ee31778074751bf6299046b8d90fcdc83e. The entire digests differ in this example; the drawing abbreviates them for reading, not for a real integrity check. No secret key is used and the readable inputs remain readable. Hash collisions are possible; SHA-256 is designed to make finding them computationally infeasible. A full digest obtained through a trusted channel can help detect alteration, but cannot by itself show whether a change was authorized or whether the source was truthful.
A hash does not encrypt data or authenticate its origin. Different inputs can share a digest; checking integrity needs a trusted full reference digest, not this shortened display.
Diagram references: NIST FIPS 180-4 - Secure Hash Standard · NIST - Hash Functions and Security Properties
AN ILLUSTRATIVE SCENARIO
Checking an approved software download
A university IT team downloads an installation image. A technician compares its digest with the value obtained through an authenticated publisher channel before using the image. A mismatch stops deployment for investigation. A match supports confidence that the bytes match that published artifact; it does not establish that the software contains no vulnerabilities.
Put it to work
- State the purpose: checking file integrity, identifying duplicate content, verifying a signature, or storing password verifiers. Select the appropriate established construction rather than using one hashing recipe for all of them.
- For file checks, obtain the expected digest from a trustworthy source and record the algorithm. Keep the reference protected from the same modification path as the file being checked.
- For password storage, use a supported password-hashing library with unique salts and suitable resource-cost settings. Plan performance testing and upgrades; do not design your own password-storage format or substitute raw SHA-256.
How to check your work
Change one byte in a test file and confirm verification fails. Then check how the expected digest is authenticated. For password storage, verify library configuration and salt handling with test accounts without printing passwords or production verifiers.
Connect the ideas
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
- Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.