Hash functions: properties and what makes one secure

A hash function takes input of any size and produces a fixed-size output (a digest) — the same input always produces the same digest, and the function only runs one direction: there's no way to reconstruct the input from the digest alone.

Notice the second example: capitalizing one letter produces a completely different digest, with no visible relationship to the first — this avalanche effect is deliberate, not an accident.

Not every function that shrinks input to a fixed size counts as a secure cryptographic hash function — three specific properties are required:

A function that shrinks input to a fixed size but lacks these properties (a simple checksum, for instance) might be genuinely useful for detecting accidental corruption, but it provides zero security guarantee against someone deliberately trying to break it — the difference between "hash function" and "cryptographic hash function" is exactly these three properties.

SHA-256 is a real, currently-secure cryptographic hash function, widely used for exactly what it's good at: verifying a downloaded file wasn't corrupted or tampered with, generating a fixed-size fingerprint of data for comparison, or as a building block inside other cryptographic constructions (lesson 5's HMAC uses a hash function internally). None of those use cases require the property passwords specifically need.

SHA-256 is designed to be fast — computing millions of hashes per second is a feature for its intended use cases (verifying a large file quickly). That exact speed is what makes it a poor fit for passwords: an attacker with a leaked list of hashed passwords can try billions of guesses per second against a fast hash function. This is precisely why Auth's password-hashing lesson reaches for bcrypt or Argon2 instead — those are deliberately, tunably slow, trading raw speed for resistance against exactly this brute-force scenario. Both bcrypt and SHA-256 are legitimate, secure cryptographic tools; they're built for different threat models, and using the fast one where the slow one is needed is the actual mistake, not a flaw in SHA-256 itself.

Nothing covered so far involves a secret key — anyone can compute SHA-256("hello") and get the same answer, which is exactly why a plain hash function alone can't authenticate a message's origin (anyone could have produced that digest). Lesson 5 covers HMAC, which combines a hash function with a secret key specifically to add that missing piece — directly building on the plain hash function concept this lesson establishes.