Understanding Cryptographic Hashing: SHA-256, MD5, and Checksums

A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size (such as a string or a file) to a bit array of a fixed size (known as a hash or checksum).

In modern application development, hashing is fundamental to data integrity verification, password storage, caching mechanisms, and security tokens.

In this guide, we will discuss properties of hash functions, common algorithms, and use cases.

Core Properties of Cryptographic Hash Functions

To be useful in security and data validation, a hashing algorithm must satisfy these key criteria:

1. Deterministic: The same input will always generate the exact same hash output.
2. Quick Computation: Computing the hash value for any input must be extremely fast.
3. Pre-image Resistant (One-way): It must be practically impossible to reverse the hash back into its original input string.
4. Collision Resistant: It must be extremely rare and difficult to find two distinct inputs that produce the same hash output.
5. Avalanche Effect: A minor change to the input (e.g. changing a single character or case) must completely and drastically change the resulting hash.

Common Cryptographic Hash Algorithms

Several hashing algorithms are widely used in software development:

1. SHA-2 (Secure Hash Algorithm 2)

Developed by the NSA, SHA-2 is the industry standard for secure hashing. It includes several size variants:

• SHA-256: Generates a 256-bit (32-byte) signature, represented as a 64-character hexadecimal string. Extremely secure and used in SSL/TLS certificates and blockchains.
• SHA-512: Generates a 512-bit signature, represented as a 128-character hexadecimal string. Optimized for 64-bit CPU architectures.

2. SHA-1 (Secure Hash Algorithm 1)

Generates a 160-bit hash. It is no longer considered secure against well-funded attacks due to theoretical collision discoveries. It should not be used for security purposes, but remains common for git checksums and legacy integrations.

3. MD5 (Message-Digest Algorithm 5)

Generates a 128-bit hash. MD5 is highly vulnerable to collision attacks where different inputs produce matching hashes. It should only be used as a simple checksum to verify file transmission integrity (like checking if a download was corrupted), never for storing passwords or cryptographic signing.

How to compute hashes in modern browsers

Modern browsers provide the Web Crypto API under window.crypto.subtle to compute secure hashes client-side without any third-party libraries:

async function sha256(message) {
  const msgBuffer = new TextEncoder().encode(message);
  const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

This native API executes asynchronously directly in the browser's crypto context, ensuring high performance.