If you’ve ever ordered hash browns, you already know where this month’s word comes from. “Hash” traces back to the French hacher, to chop. Take something, chop it up, and mix it until you can’t tell what went in. Developers borrowed the word for something that does roughly the same thing to data.
Some quick definitions:
A hash (noun): a short, fixed-length string of characters produced from any piece of data, whether that’s one word or an entire file.
To hash (verb): to run data through a hash function to get that string.
The three rules of a good hash
Rule 1: Same in, same out. Hash the word “pancake” today and hash it again next year, and you’ll get the identical result both times.
Rule 2: A tiny change scrambles everything. Here’s what a common hash function (SHA-256) makes of two nearly identical words:
- pancake:
a9c1034fb623883b5786268bbde25a87... - pancakes:
d0403be2999c4899ef3a3e3d66d55df4...
One extra letter, and the two results look completely unrelated.
Rule 3: There’s no going backward. You can’t take a hash and work out what made it, except by guessing and checking. The chopping only goes one direction.
Why your password is safer because of it
Here’s where hashing earns its keep. When you create an account on a well-built system, it stores a hash of your password instead of the password itself. The next time you log in, it hashes whatever you typed and compares the two. If they match, you’re in.
So if someone ever broke into that database, all they’d find is a list of fingerprints. To recover a password, they’d have to guess it and check it, one fingerprint at a time.
Good systems add two more precautions:
- A salt. Before hashing, the system mixes a random bit of extra data into each password. That way, two people who both picked “Password123” (please don’t) end up with completely different hashes, and an attacker can’t crack everyone’s at once with a precomputed list.
- Deliberately slow math. Password hashing is built to take a little extra time. For you, logging in once, a fraction of a second is nothing. For an attacker trying billions of guesses, it adds up to years for a decent password. The most common methods have names only a developer could love: bcrypt, scrypt, Argon2, and PBKDF2, which comes built into Microsoft’s .NET login tools.
Hash or encryption?
People often mix them up, but they do opposite jobs. Encryption scrambles data so someone with the right key can unscramble it later, like a locked box. Hashing is more like a paper shredder that turns the same page into the same confetti every time. You encrypt things you’ll need to read again, like a medical record. You hash things you only need to check, like a password.
Where else hashes show up
- Downloads. Some software sites list a hash next to the download link. Hash the file you got, compare the two, and you’ll know it arrived exactly as intended, with nothing swapped or corrupted along the way.
- Tracking code changes. Every saved change in Git, the tool most developers use to track their code, gets an ID that’s a hash of its contents. Change a single character, and the ID changes.
- Finding things fast. A hash table uses hashing to jump straight to where something’s stored instead of searching the whole list. It’s a big reason software can pull one record out of millions in an instant.
And the # key?
In the UK, # is called the hash key, and that’s where the “hash” in hashtag comes from. That puts one little word on triple duty: breakfast, passwords, and every #TBT you’ve ever posted.
So the next time someone says “let’s hash it out,” you’re allowed to ask which kind.