Understanding Hash Functions: MD5, SHA1, SHA256 and Beyond

Input: "Hello, World!"
MD5:   65a8e27d8879283831b664bd8b7f0ad4

Input: "Hello, World"
MD5:   bea8252ff4e80f41719ea13cdf007273

Note: Just removing one character produces a completely different hash (avalanche effect)

Input: "Hello, World!"
SHA-1: 0a0a9f2a6772942557ab5355d76af442f8f65e01

Input: "Hello, World"
SHA-1: 2ef7bde608ce5404e97d5f042f95f89f1c232871

Input: "Hello, World!"
SHA-256: dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f

Input: "Hello, World"
SHA-256: 03ba204e50d126e4674c005e04d82e84c21366780af1f43bd54a37816b6ab340

Hash length is always 64 hexadecimal characters (256 bits)

Input: "Hello, World!"
SHA-512: 374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6cc69291e0fa2fe0006a52570ef18c19def4e617c33ce52ef0a6e5fbe318cb0387

Hash length is always 128 hexadecimal characters (512 bits)

// ❌ WRONG - Never do this!
const hashedPassword = sha256(password);
// Fast hashes can be brute-forced quickly

// ✅ CORRECT - Use bcrypt
const bcrypt = require('bcrypt');
const saltRounds = 12;

async function hashPassword(password) {
  const hash = await bcrypt.hash(password, saltRounds);
  return hash;
  // Example: $2b$12$KIXl.DxJvKTYy6Wgma5WyOqJ9sXNJKz7h3fGNQjYp4p1234567890
}

async function verifyPassword(password, hash) {
  return await bcrypt.compare(password, hash);
}

const crypto = require('crypto');
const fs = require('fs');

function calculateFileHash(filepath) {
  return new Promise((resolve, reject) => {
    const hash = crypto.createHash('sha256');
    const stream = fs.createReadStream(filepath);

    stream.on('data', (data) => hash.update(data));
    stream.on('end', () => resolve(hash.digest('hex')));
    stream.on('error', reject);
  });
}

// Usage
const hash = await calculateFileHash('myfile.zip');
console.log(`File hash: ${hash}`);

// Compare with expected hash
const expectedHash = '374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6c';
if (hash === expectedHash) {
  console.log('File integrity verified!');
} else {
  console.error('File has been modified or corrupted!');
}

const crypto = require('crypto');

function signMessage(message, privateKey) {
  // Hash the message first
  const hash = crypto.createHash('sha256').update(message).digest();

  // Sign the hash
  const sign = crypto.createSign('RSA-SHA256');
  sign.update(hash);
  return sign.sign(privateKey, 'base64');
}

function verifySignature(message, signature, publicKey) {
  const hash = crypto.createHash('sha256').update(message).digest();

  const verify = crypto.createVerify('RSA-SHA256');
  verify.update(hash);
  return verify.verify(publicKey, signature, 'base64');
}

// Usage
const message = 'Important contract terms...';
const signature = signMessage(message, privateKey);
const isValid = verifySignature(message, signature, publicKey);
console.log(`Signature valid: ${isValid}`);

import hashlib
from pathlib import Path

def find_duplicate_files(directory):
    """Find duplicate files by comparing SHA-256 hashes"""
    hash_dict = {}
    duplicates = []

    for filepath in Path(directory).rglob('*'):
        if filepath.is_file():
            # Calculate file hash
            file_hash = hashlib.sha256(filepath.read_bytes()).hexdigest()

            # Check for duplicates
            if file_hash in hash_dict:
                duplicates.append((filepath, hash_dict[file_hash]))
            else:
                hash_dict[file_hash] = filepath

    return duplicates

# Usage
duplicates = find_duplicate_files('/path/to/directory')
for dup1, dup2 in duplicates:
    print(f'Duplicate found: {dup1} == {dup2}')

const crypto = require('crypto');

function generateCacheKey(url, params) {
  // Create unique cache key from URL and parameters
  const data = JSON.stringify({ url, params });
  return crypto.createHash('md5').update(data).digest('hex');
}

// Usage
const key1 = generateCacheKey('/api/users', { page: 1, limit: 10 });
const key2 = generateCacheKey('/api/users', { page: 2, limit: 10 });

console.log(key1); // f4c842d70e2d5e8a7b3e6b9c8d5f2a1b
console.log(key2); // a7d9e4c3b2f1e8d7c6b5a4f3e2d1c0b9

// Different inputs produce different cache keys
// MD5 is fast and collision probability is acceptable for caching

const crypto = require('crypto');

class Block {
  constructor(index, timestamp, data, previousHash) {
    this.index = index;
    this.timestamp = timestamp;
    this.data = data;
    this.previousHash = previousHash;
    this.nonce = 0;
    this.hash = this.calculateHash();
  }

  calculateHash() {
    return crypto
      .createHash('sha256')
      .update(
        this.index +
        this.previousHash +
        this.timestamp +
        JSON.stringify(this.data) +
        this.nonce
      )
      .digest('hex');
  }

  // Proof of work - mine block
  mineBlock(difficulty) {
    const target = '0'.repeat(difficulty);
    while (!this.hash.startsWith(target)) {
      this.nonce++;
      this.hash = this.calculateHash();
    }
    console.log(`Block mined: ${this.hash}`);
  }
}

// Usage
const block = new Block(1, Date.now(), { amount: 100 }, '0');
block.mineBlock(4); // Find hash starting with 0000

// Node.js crypto module
const crypto = require('crypto');

const text = 'Hello, World!';

// MD5
const md5 = crypto.createHash('md5').update(text).digest('hex');
console.log('MD5:', md5);

// SHA-1
const sha1 = crypto.createHash('sha1').update(text).digest('hex');
console.log('SHA-1:', sha1);

// SHA-256
const sha256 = crypto.createHash('sha256').update(text).digest('hex');
console.log('SHA-256:', sha256);

// SHA-512
const sha512 = crypto.createHash('sha512').update(text).digest('hex');
console.log('SHA-512:', sha512);

// HMAC with SHA-256
const hmac = crypto
  .createHmac('sha256', 'secret-key')
  .update(text)
  .digest('hex');
console.log('HMAC-SHA256:', hmac);

// Browser Web Crypto API
async function hashInBrowser(text) {
  const encoder = new TextEncoder();
  const data = encoder.encode(text);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

import hashlib

text = "Hello, World!"
data = text.encode('utf-8')

# MD5
md5_hash = hashlib.md5(data).hexdigest()
print(f"MD5: {md5_hash}")

# SHA-1
sha1_hash = hashlib.sha1(data).hexdigest()
print(f"SHA-1: {sha1_hash}")

# SHA-256
sha256_hash = hashlib.sha256(data).hexdigest()
print(f"SHA-256: {sha256_hash}")

# SHA-512
sha512_hash = hashlib.sha512(data).hexdigest()
print(f"SHA-512: {sha512_hash}")

# HMAC
import hmac
hmac_hash = hmac.new(
    b'secret-key',
    data,
    hashlib.sha256
).hexdigest()
print(f"HMAC-SHA256: {hmac_hash}")

# For files
def hash_file(filepath):
    sha256 = hashlib.sha256()
    with open(filepath, 'rb') as f:
        for chunk in iter(lambda: f.read(4096), b''):
            sha256.update(chunk)
    return sha256.hexdigest()

<?php
$text = "Hello, World!";

// MD5
$md5 = md5($text);
echo "MD5: $md5\n";

// SHA-1
$sha1 = sha1($text);
echo "SHA-1: $sha1\n";

// SHA-256
$sha256 = hash('sha256', $text);
echo "SHA-256: $sha256\n";

// SHA-512
$sha512 = hash('sha512', $text);
echo "SHA-512: $sha512\n";

// HMAC
$hmac = hash_hmac('sha256', $text, 'secret-key');
echo "HMAC-SHA256: $hmac\n";

// For files
$file_hash = hash_file('sha256', 'myfile.txt');

// List all available algorithms
$algorithms = hash_algos();
print_r($algorithms);
?>

import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import javax.xml.bind.DatatypeConverter;

public class HashExample {
    public static String hash(String text, String algorithm) {
        try {
            MessageDigest digest = MessageDigest.getInstance(algorithm);
            byte[] hash = digest.digest(text.getBytes(StandardCharsets.UTF_8));
            return DatatypeConverter.printHexBinary(hash).toLowerCase();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    public static void main(String[] args) {
        String text = "Hello, World!";

        System.out.println("MD5: " + hash(text, "MD5"));
        System.out.println("SHA-1: " + hash(text, "SHA-1"));
        System.out.println("SHA-256: " + hash(text, "SHA-256"));
        System.out.println("SHA-512: " + hash(text, "SHA-512"));
    }
}

# Linux/Mac

# MD5
echo -n "Hello, World!" | md5sum
md5 -s "Hello, World!"  # Mac

# SHA-1
echo -n "Hello, World!" | sha1sum
shasum -a 1 <<< "Hello, World!"

# SHA-256
echo -n "Hello, World!" | sha256sum
shasum -a 256 <<< "Hello, World!"

# SHA-512
echo -n "Hello, World!" | sha512sum

# For files
sha256sum myfile.txt
md5sum myfile.txt

# Windows PowerShell
Get-FileHash myfile.txt -Algorithm SHA256
Get-FileHash myfile.txt -Algorithm MD5

# MD5 Collision Example (2008)
# Two different PDF files with identical MD5 hashes:

File 1 (legitimate): MD5 = d131dd02c5e6eec4693d9a0698aff95c
File 2 (malicious): MD5 = d131dd02c5e6eec4693d9a0698aff95c

# Even though files are completely different,
# they produce the same MD5 hash!

# SHA-1 Collision (2017 - SHAttered attack)
# Google demonstrated practical SHA-1 collision:
# Two different PDF files with same SHA-1 hash

This is why MD5 and SHA-1 should not be used
for security-critical applications!

# Without salt - vulnerable to rainbow tables
Password: "password123"
MD5: 482c811da5d5b4bc6d497ffa98491e38

Attacker has precomputed table:
password123 → 482c811da5d5b4bc6d497ffa98491e38 ✓
letmein     → 0d107d09f5bbe40cade3de5c71e9e9b7
qwerty      → d8578edf8458ce06fbc5bb76a58c5ca4

# With salt - rainbow table useless
Password: "password123"
Salt: "8f4b9c7e2d1a"
Hash: bcrypt("password123" + salt)
→ $2b$12$8f4b9c7e2d1a9f6b8c5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f

Each password has unique salt,
making precomputed tables impossible!

// ❌ VULNERABLE to length extension attack
function insecureAuth(message, secretKey) {
  return crypto.createHash('sha256')
    .update(secretKey + message)
    .digest('hex');
}

// Attacker can forge valid signatures!

// ✅ SECURE - Use HMAC instead
function secureAuth(message, secretKey) {
  return crypto.createHmac('sha256', secretKey)
    .update(message)
    .digest('hex');
}

// HMAC prevents length extension attacks

// ❌ VULNERABLE - String comparison reveals info through timing
function insecureCompare(hash1, hash2) {
  return hash1 === hash2;
  // Returns immediately on first different character
  // Attacker can deduce hash by measuring response time
}

// ✅ SECURE - Constant-time comparison
function secureCompare(hash1, hash2) {
  if (hash1.length !== hash2.length) {
    return false;
  }

  let result = 0;
  for (let i = 0; i < hash1.length; i++) {
    result |= hash1.charCodeAt(i) ^ hash2.charCodeAt(i);
  }
  return result === 0;
  // Always takes same time regardless of differences
}

// Or use crypto.timingSafeEqual in Node.js
const crypto = require('crypto');
const hash1 = Buffer.from('abc123', 'utf8');
const hash2 = Buffer.from('abc456', 'utf8');
const equal = crypto.timingSafeEqual(hash1, hash2);

Hash Algorithm | Speed       | Hash Size | Performance Rank
---------------|-------------|-----------|------------------
MD5            | Very Fast   | 128 bits  | ⚡⚡⚡⚡⚡ (1st)
SHA-1          | Fast        | 160 bits  | ⚡⚡⚡⚡ (2nd)
SHA-256        | Moderate    | 256 bits  | ⚡⚡⚡ (3rd)
SHA-512        | Moderate    | 512 bits  | ⚡⚡⚡ (3rd)
SHA-3-256      | Slower      | 256 bits  | ⚡⚡ (4th)
bcrypt         | Very Slow*  | Variable  | ⚡ (5th)

*bcrypt is intentionally slow to prevent brute-force attacks

Hash Algorithm | Security Status        | Recommended Use
---------------|------------------------|----------------------------------
MD5            | ❌ Broken             | Checksums only (non-security)
SHA-1          | ⚠️ Deprecated         | Legacy systems only
SHA-256        | ✅ Secure             | General cryptography, signatures
SHA-512        | ✅ Highly Secure      | High-security applications
SHA-3          | ✅ Secure             | Future-proof, SHA-2 alternative
bcrypt         | ✅ Password Hashing   | Password storage
Argon2         | ✅ Password Hashing   | Modern password storage (best)

Need to hash data?
│
├─ Password storage?
│  │
│  ├─ YES → Use bcrypt, Argon2, or scrypt
│  └─ NO → Continue...
│
├─ Security critical? (signatures, certificates)
│  │
│  ├─ YES → Use SHA-256 or SHA-512
│  └─ NO → Continue...
│
├─ File integrity/checksum?
│  │
│  ├─ Security matters → SHA-256
│  └─ Speed matters → MD5 or CRC32
│
└─ Caching/deduplication?
   │
   └─ MD5 or SHA-1 (collisions acceptable)

const crypto = require('crypto');

function hashPasswordWithSalt(password) {
  // Generate random salt (16 bytes)
  const salt = crypto.randomBytes(16).toString('hex');

  // Hash password with salt
  const hash = crypto
    .pbkdf2Sync(password, salt, 100000, 64, 'sha512')
    .toString('hex');

  // Store both salt and hash
  return { salt, hash };
}

function verifyPassword(password, salt, hash) {
  const hashToVerify = crypto
    .pbkdf2Sync(password, salt, 100000, 64, 'sha512')
    .toString('hex');

  return hash === hashToVerify;
}

// Usage
const { salt, hash } = hashPasswordWithSalt('myPassword123');
console.log('Salt:', salt);
console.log('Hash:', hash);

// Store both in database:
// user.salt = salt;
// user.hash = hash;

// Verify later:
const isValid = verifyPassword('myPassword123', salt, hash);

const crypto = require('crypto');

function generateHMAC(message, secretKey) {
  return crypto
    .createHmac('sha256', secretKey)
    .update(message)
    .digest('hex');
}

function verifyHMAC(message, secretKey, receivedHMAC) {
  const calculatedHMAC = generateHMAC(message, secretKey);

  // Use constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(calculatedHMAC),
    Buffer.from(receivedHMAC)
  );
}

// API example: Sign webhook payload
const payload = JSON.stringify({ event: 'user.created', id: 123 });
const secret = 'my-webhook-secret';
const signature = generateHMAC(payload, secret);

// Send to client:
// X-Signature: signature

// Client verifies:
const isValid = verifyHMAC(payload, secret, signature);
console.log('Signature valid:', isValid);

function safeHash(input, algorithm = 'sha256') {
  // Validate algorithm
  const allowedAlgorithms = ['md5', 'sha1', 'sha256', 'sha512'];
  if (!allowedAlgorithms.includes(algorithm)) {
    throw new Error('Invalid hash algorithm');
  }

  // Validate input
  if (typeof input !== 'string' && !Buffer.isBuffer(input)) {
    throw new Error('Input must be string or Buffer');
  }

  // Size limit (e.g., 10MB)
  const maxSize = 10 * 1024 * 1024;
  const size = Buffer.byteLength(input);
  if (size > maxSize) {
    throw new Error(`Input too large: ${size} bytes`);
  }

  try {
    return crypto.createHash(algorithm).update(input).digest('hex');
  } catch (error) {
    throw new Error(`Hashing failed: ${error.message}`);
  }
}

// ❌ WRONG - Hashing is NOT encryption!
const "encrypted" = sha256("sensitive data");
// Cannot get original data back!

// Hash: one-way function
// Encryption: two-way function (encrypt/decrypt)

// ✅ CORRECT - Use encryption for two-way
const crypto = require('crypto');
const algorithm = 'aes-256-cbc';
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);

function encrypt(text) {
  const cipher = crypto.createCipheriv(algorithm, key, iv);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return encrypted;
}

function decrypt(encrypted) {
  const decipher = crypto.createDecipheriv(algorithm, key, iv);
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

// ❌ WRONG - No salt (rainbow table attack)
const hashedPassword = sha256("password123");
// 482c811da5d5b4bc6d497ffa98491e38
// Same hash for all users with this password!

// ✅ CORRECT - Use unique salt per password
const crypto = require('crypto');

function hashPassword(password) {
  const salt = crypto.randomBytes(16).toString('hex');
  const hash = crypto
    .pbkdf2Sync(password, salt, 100000, 64, 'sha512')
    .toString('hex');
  return `${salt}:${hash}`;
}

// Result: Different hash for each user
// User 1: a1b2c3:d4e5f6...
// User 2: x9y8z7:w6v5u4...

// ❌ WRONG - Fast hashes for passwords
const hash = md5(password);        // Can try billions per second
const hash = sha256(password);     // Can try millions per second

// Attacker can brute-force quickly!

// ✅ CORRECT - Slow, purpose-built algorithms
const bcrypt = require('bcrypt');
const hash = await bcrypt.hash(password, 12);
// Can try only thousands per second
// Each increase in cost doubles the time

// Or use Argon2 (even better)
const argon2 = require('argon2');
const hash = await argon2.hash(password);

// ❌ WRONG - Using MD5 for security
function verifyFileIntegrity(file, expectedMD5) {
  const actualMD5 = md5(file);
  return actualMD5 === expectedMD5;
}
// Attacker can create malicious file with same MD5!

// ✅ CORRECT - Use SHA-256 or SHA-512
function verifyFileIntegrity(file, expectedSHA256) {
  const actualSHA256 = sha256(file);
  return actualSHA256 === expectedSHA256;
}
// SHA-256 collisions are practically impossible

// MD5 is OK for:
// - Non-security checksums
// - Cache keys
// - Duplicate detection (with low collision risk)

// ❌ WRONG - Weak or predictable salt
const salt = "mysalt";                    // Same for all users
const salt = username;                    // Predictable
const salt = Date.now().toString();       // Too small entropy

// ✅ CORRECT - Strong, random, unique salt
const crypto = require('crypto');
const salt = crypto.randomBytes(32).toString('hex');
// 64 characters of cryptographically random data

// Minimum: 16 bytes (128 bits)
// Recommended: 32 bytes (256 bits)

// ❌ WRONG - Timing attack vulnerability
function compareHashes(hash1, hash2) {
  return hash1 === hash2;
  // Fails fast on first difference
}

// ✅ CORRECT - Constant-time comparison
function compareHashesSecure(hash1, hash2) {
  if (hash1.length !== hash2.length) {
    return false;
  }

  let diff = 0;
  for (let i = 0; i < hash1.length; i++) {
    diff |= hash1.charCodeAt(i) ^ hash2.charCodeAt(i);
  }
  return diff === 0;
}

// Or use built-in in Node.js
const crypto = require('crypto');
crypto.timingSafeEqual(
  Buffer.from(hash1),
  Buffer.from(hash2)
);

# Generate hashes from command line

# MD5
md5sum file.txt
echo -n "text" | md5sum

# SHA-256
sha256sum file.txt
echo -n "text" | sha256sum

# SHA-512
sha512sum file.txt

# Verify checksums
sha256sum -c checksums.txt

# OpenSSL (alternative)
openssl dgst -md5 file.txt
openssl dgst -sha256 file.txt
openssl dgst -sha512 file.txt

# Hash password with bcrypt (htpasswd)
htpasswd -nbB username password