Cryptography & Hashing Complete Guide: Algorithms, Security & Best Practices

Cryptographic hash functions are fundamental to modern security—powering everything from password storage to file integrity verification to blockchain technology. This guide covers the essential hashing algorithms, their appropriate use cases, and critical security considerations.

What Is a Hash Function?

A cryptographic hash function takes input data of any size and produces a fixed-size output (the hash or digest). Key properties:

• Deterministic: Same input always produces same output
• One-way: Cannot reverse the hash to find the original input
• Collision-resistant: Extremely difficult to find two inputs with the same hash
• Avalanche effect: Small input changes produce completely different hashes

Input: "Hello World"
MD5:    b10a8db164e0754105b7a99be72e3fe5
SHA-256: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Hash Algorithm Comparison

📚 MD5 vs SHA-256 vs SHA-512 Differences: Detailed comparison of common hash algorithms.

When to Use Each Algorithm

SHA-256: The Modern Standard

SHA-256 is the go-to choice for most applications:

• File integrity verification
• Digital signatures
• Certificate fingerprints
• Blockchain (Bitcoin uses SHA-256)
• HMAC authentication

SHA-512: Maximum Security

Use SHA-512 when you need:

• Maximum collision resistance
• Higher security margins
• Systems that process 64-bit data efficiently
• Future-proofing against quantum computing

SHA-3: The Future

SHA-3 (Keccak) provides an alternative construction:

• Different mathematical foundation than SHA-2
• Useful when SHA-2 vulnerabilities are discovered
• Emerging standard for high-security applications

📚 SHA-3 vs SHA-2 Comparison: Understanding the differences and when to choose SHA-3.

MD5: Legacy Only

MD5 should only be used for:

• Non-security checksums (file downloads)
• Legacy system compatibility
• Fingerprinting (not security-critical)

⚠️ Never use MD5 for security purposes—collisions can be generated in seconds.

📚 When MD5 Is Still Acceptable: Limited scenarios where MD5 remains valid.

Password Hashing: A Special Case

Regular hash functions like SHA-256 are not appropriate for passwords. Here's why:

• Too fast: Attackers can try billions of passwords per second
• No salting: Same password produces same hash
• Rainbow tables: Precomputed hash tables break weak passwords instantly

📚 Why Never Use MD5/SHA-256 for Passwords: Critical security implications.

Password Hashing Best Practices

Use purpose-built password hashing functions:

1. Argon2 (Recommended)

• Winner of the Password Hashing Competition
• Memory-hard (resistant to GPU attacks)
• Configurable parameters

2. bcrypt

• Time-tested, widely supported
• Built-in salting
• Adjustable work factor

3. scrypt

• Memory-hard like Argon2
• Good alternative when Argon2 unavailable

// Good: bcrypt with cost factor 12
const hash = await bcrypt.hash(password, 12);

// Bad: SHA-256 for passwords
const hash = crypto.createHash('sha256').update(password).digest('hex');

Rainbow Tables and Salting

Rainbow tables are precomputed hash-to-password mappings that instantly crack unsalted hashes.

How salts protect passwords:

1. Add unique random value (salt) to each password
2. Hash the combination: hash(salt + password)
3. Store both salt and hash
4. Rainbow tables become useless (would need one per salt)

📚 Rainbow Tables and How Salts Protect Passwords: Understanding this critical defense.

Hash Reversibility and Lookups

Hashes are not reversible, but weak hashes can be cracked:

• Rainbow tables: Precomputed lookups for common passwords
• Brute force: Try all possible inputs
• Dictionary attacks: Try common passwords and variations
• Hash databases: Online services with billions of known hashes

📚 Are Hash Functions Reversible?: Understanding hash security limitations.

File Integrity Verification

Hashes verify that files haven't been modified:

# Generate SHA-256 hash
sha256sum software.zip
# Output: a591a6d40bf420... software.zip

# Verify against published hash
echo "a591a6d40bf420... software.zip" | sha256sum -c
# Output: software.zip: OK

Use cases:

• Software download verification
• Backup integrity
• Evidence preservation (forensics)
• Configuration file monitoring

📚 How Hash Functions Verify File Integrity: Practical implementation guide.

XOR Operations in Cryptography

XOR (exclusive or) is fundamental to many encryption algorithms:

• Stream ciphers (XOR plaintext with keystream)
• Block cipher modes
• One-time pads (perfect secrecy when done correctly)

However, simple XOR ciphers are insecure:

📚 Why XOR Cipher Is Insecure: Cryptanalysis of XOR encryption.

XOR Resources

• Practical XOR Applications - Legitimate uses
• XOR in Modern Cryptography - How it's used correctly
• XOR Frequency Analysis - Breaking XOR ciphers
• XOR in Malware Obfuscation - Security implications

Classic Ciphers (Educational)

Understanding classic ciphers helps appreciate modern cryptography:

• Caesar Cipher: Simple letter substitution (rotate by N)
• ROT13: Caesar cipher with rotation of 13
• Vigenère: Polyalphabetic substitution

📚 Caesar Cipher vs ROT13: Historical cipher comparison.

⚠️ Classic ciphers provide no security—they're trivially broken.

Cryptographic Tools

Security Best Practices

For Passwords

1. Use Argon2 or bcrypt, never SHA-256/MD5
2. Generate unique salts for each password
3. Set appropriate work factors (higher = more secure but slower)
4. Never store plaintext passwords
5. Implement rate limiting against brute force

For File Integrity

1. Use SHA-256 or SHA-512 (not MD5)
2. Store hashes securely (separate from files)
3. Verify before executing downloaded software
4. Monitor for changes in critical files

For General Cryptography

1. Use established libraries (don't roll your own)
2. Keep algorithms updated (retire deprecated ones)
3. Follow industry standards (NIST, OWASP)
4. Plan for quantum (post-quantum algorithms emerging)

Conclusion

Cryptographic hashing is essential for modern security, but choosing the right algorithm matters:

• General hashing: SHA-256 or SHA-512
• Password storage: Argon2 or bcrypt (never SHA-256/MD5)
• Future-proofing: Consider SHA-3
• Legacy compatibility: MD5 only for non-security checksums

The key principle: use purpose-built tools for each job. General-purpose hash functions are fast by design—excellent for checksums, terrible for passwords. Password hashing functions are deliberately slow—perfect for protecting credentials, wasteful for file verification.

Understanding these distinctions and implementing appropriate algorithms protects both your systems and your users.