---
title: What Is a Hash Function? A Plain-English Guide | Relic
description: A hash function turns any input into a fixed fingerprint that cannot be run backwards. What hashing is for, how it differs from encryption, and where it hides.
canonical: https://relic.space/blog/what-is-a-hash-function
source: https://relic.space/llms.txt
---
[Developer copy and paste](https://relic.space/blog/topics/dev-toolbox)

# What is a hash function?

A hash function takes any input, of any size, and produces a short fixed-size fingerprint. You cannot run it backwards to recover the input. That one-way quality is what makes hashing useful for passwords, file checks, and a lot of the plumbing behind modern software.

[JGJordan Gibbs](https://relic.space/authors/jordan-gibbs) June 29, 2026 8 min readUpdated September 12, 2026

## What is a hash function in simple terms?

A hash function turns any input into a fixed-size fingerprint called a digest. SHA-256 always returns 256 bits, written as 64 hexadecimal characters, whether you feed it one letter or a whole novel. The same input always gives the same digest, and there is no way to run the function backwards.

Feed a hash function the single letter **a** and it spits out a fixed-length string of characters. Feed it the entire text of a novel and it spits out a string of the exact same length. Change one comma in that novel and the output changes completely, with no resemblance to the version before. That is the whole idea of a hash function: it turns any input into a short, consistent fingerprint, and it does so the same way every single time.

The proper name for that fingerprint is a **hash**, or sometimes a digest. People reach for hashing constantly without naming it, because it quietly powers password checks, download verification, and the way many databases find things fast. If you want to see one in action, you can paste any text into our [hash generator](https://relic.space/tools/hash-generator) and watch the digest update as you type.

## What does a hash function actually do?

A hash function is a piece of math with three jobs. It accepts an input of any length. It always returns an output of a fixed length. And for the same input, it always returns the same output. Run [SHA-256](https://csrc.nist.gov/pubs/fips/180-4/upd1/final), the most common member of the SHA-2 family, over the word **hello** and you get a 256-bit digest, written as a 64-character hexadecimal string. Run it over **hello** again tomorrow, on a different computer, and you get the identical 64 characters.

That fixed length is the key trick. Whether the input is one byte or one gigabyte, the fingerprint comes out the same size. The function squeezes and mixes the data so thoroughly that the output looks random, even though it is completely determined by the input. There is nothing secret going on. Anyone running the same algorithm gets the same answer.

### The three properties that make it useful

* **Deterministic.** The same input always produces the same hash. This is what lets you compare two things by comparing their fingerprints instead of the things themselves.
* **One-way.** Given a hash, there is no practical way to work out the input it came from. You can go from input to hash, but not back.
* **Avalanche effect.** A tiny change to the input, even a single character, produces a wildly different hash. There is no gentle drift, so you cannot tell from two hashes whether their inputs were similar.

## Why does one-way matter for passwords?

The classic use of hashing is storing passwords. A sensible website never keeps your actual password on file. When you sign up, it hashes your password and stores only the hash. When you log back in, it hashes whatever you typed and checks whether the two hashes match. The site can confirm you know the password without ever holding the password itself.

This is exactly why a one-way function is the right tool. If the company is breached and the database leaks, the attacker gets a pile of hashes, not your password. There is no decode button. The catch is that attackers can still guess: take a huge list of common passwords, hash each one, and look for matches. That is why [NIST requires passwords to be salted and hashed with a password hashing scheme](https://pages.nist.gov/800-63-4/sp800-63b.html), so a random value goes in with each password and the work factor can be dialled up. [OWASP’s first choice is Argon2id](https://cheatsheetseries.owasp.org/cheatsheets/Password%5FStorage%5FCheat%5FSheet.html), with scrypt next and bcrypt for legacy systems. All of them are deliberately slow, which makes mass guessing painfully expensive.

Hashing protects a password by never storing it. Encryption protects a message by storing it scrambled and handing the key to the right person. Different jobs, and mixing them up is one of the most common mistakes in this area.

## Hashing is not encryption

The two get confused constantly, so let us be precise. **Encryption is two-way.** You scramble data with a key, and someone with the right key can unscramble it back to the original. The whole point is to get the data back later. **Hashing is one-way.** There is no key, and there is no getting the input back. The point is to produce a fingerprint, not to recover anything.

So you encrypt a file you want to read again, and you hash a password you never want to store. If you are weighing the two for a real project, we pull the distinction apart properly in [hashing vs encryption](https://relic.space/blog/hashing-vs-encryption), and the broader idea of keeping data readable only to its owner is covered in [what is end-to-end encryption](https://relic.space/blog/what-is-end-to-end-encryption).

## Where is hashing used?

Once you know the shape of it, you start seeing hashing everywhere in software.

* **File and download checks.** When a download page lists a SHA-256 value next to a file, you can hash the file you received and compare. If the two match, the file arrived intact and unaltered. If even one bit changed in transit, the hashes will not match.
* **Data integrity.** Version control like Git names every commit by a hash of its contents, so any tampering with history is immediately detectable.
* **Fast lookups.** Hash tables, the structure behind dictionaries and maps in most programming languages, use hashing to jump straight to where a value is stored instead of scanning everything.
* **Deduplication.** Systems that store a lot of files often hash each one to spot duplicates, keeping a single copy when two inputs share a fingerprint.

## What makes a hash function strong?

Not all hash functions are fit for security work. Because the output is a fixed size and the input is unlimited, two different inputs will sometimes produce the same hash. That is a **collision**, and in pure math it is unavoidable. The mark of a strong hash function is that finding a collision on purpose is so hard that it never happens in practice.

This is where older algorithms fall down. MD5 and SHA-1 were once standard, and researchers have since shown how to manufacture collisions in both. A serious attack on the collision resistance of SHA-1 was announced in 2005, and [NIST is retiring SHA-1 entirely, with the transition due to be complete by December 31, 2030](https://csrc.nist.gov/news/2022/nist-transitioning-away-from-sha-1-for-all-apps). Neither algorithm should be trusted for signatures or integrity checks. They still do the job as a plain non-security checksum. For modern work, SHA-256 is the safe general-purpose choice, and password storage should use a slow, salted algorithm built for the job rather than a fast general hash.

## The short version

A hash function turns any input into a short, fixed fingerprint that you cannot reverse. The same input always gives the same fingerprint, a tiny change gives a totally different one, and there is no key and no way back. That makes it the right tool for checking passwords without storing them, confirming a file is intact, and finding data quickly. It is a different job from encryption, which exists to give your data back. Hashing exists to prove something without revealing it. If this fits into a wider toolkit of developer copy-and-paste habits, our guide on [copying and pasting in the terminal](https://relic.space/blog/copy-and-paste-in-the-terminal) and the explainer on [what a UUID is](https://relic.space/blog/what-is-a-uuid) are good neighbours to this one.

## Sources

* [FIPS 180-4: Secure Hash Standard (SHS)](https://csrc.nist.gov/pubs/fips/180-4/upd1/final), NIST (2015)
* [NIST Transitioning Away from SHA-1 for All Applications](https://csrc.nist.gov/news/2022/nist-transitioning-away-from-sha-1-for-all-apps), NIST (2022)
* [SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html), NIST (2025)
* [Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password%5FStorage%5FCheat%5FSheet.html), OWASP

## Frequently asked questions

Is hashing the same as encryption?+

No. Encryption is a two-way process: you scramble data with a key and later use a key to get the original back. Hashing is one-way, so there is no key and no way to reverse it. You hash a password to check it later without storing the password itself, and you encrypt a message so the right person can read it again.

Can a hash be reversed back to the original input?+

Not directly. A good hash function throws away the structure of the input and produces a fixed-size fingerprint, so there is no decode step. The only way to find an input that matches a hash is to guess inputs, hash each one, and compare, which is why long random inputs are effectively impossible to recover.

What does it mean when two inputs have the same hash?+

That is called a collision. Because a hash is a fixed size, an unlimited number of inputs map to a limited number of outputs, so collisions must exist in theory. A strong hash function makes finding one so hard that it never happens by accident, which is what keeps it trustworthy for security work.

Which hash function should I use?+

For verifying files or data, SHA-256 is the common, safe default. For storing passwords, use a slow algorithm built for it, such as bcrypt, scrypt, or Argon2, never a plain fast hash. Avoid MD5 and SHA-1 for anything security-related, since both are broken for collision resistance.

JG

Written by

[Jordan Gibbs](https://relic.space/authors/jordan-gibbs)Founder, Relic

Jordan Gibbs is the founder of Relic, an end-to-end encrypted, permanent, searchable memory for everything you copy. He writes widely about AI, agents, and practical tooling on Medium, where he is read by tens of thousands, and builds privacy-first software. Here he covers how everyday tools like the clipboard actually work, and how to use them without handing your data to someone else.

[Medium](https://medium.com/@jordan%5Fgibbs)[GitHub](https://github.com/jordan-gibbs)[LinkedIn](https://www.linkedin.com/in/jordan--gibbs/)

Part of

[Developer copy and paste](https://relic.space/blog/topics/dev-toolbox)
* [How to copy and paste in the terminal· pillar](https://relic.space/blog/copy-and-paste-in-the-terminal)
* [What is a UUID?](https://relic.space/blog/what-is-a-uuid)
* [What is a JWT token?](https://relic.space/blog/what-is-a-jwt-token)
* [What is Base64 encoding?](https://relic.space/blog/what-is-base64-encoding)
* [How to copy a file path](https://relic.space/blog/how-to-copy-a-file-path)
* [Hashing vs encryption: what is the difference?](https://relic.space/blog/hashing-vs-encryption)

Keep reading

[Pillar·13 minHow to copy and paste in the terminalCtrl C cancels a command in the terminal, so copy and paste works differently there. Shortcuts for every terminal, plus SSH, PuTTY, Termius and browser terminals.Read ](https://relic.space/blog/copy-and-paste-in-the-terminal)[7 minWhat is a UUID?A UUID is a 128-bit value designed to be unique without any central authority handing it out. What they are, how the versions differ, and when to reach for one.Read ](https://relic.space/blog/what-is-a-uuid)[7 minWhat is a JWT token?A JWT packs a user's identity into a signed, self-contained token. What the three parts hold, how the signature works, and what a JWT does and does not protect.Read ](https://relic.space/blog/what-is-a-jwt-token)

developerencryptionsecurity