Hashing Basics: Digests, Integrity, and IDs

Overview

A cryptographic hash function maps arbitrary input to a fixed-size digest. Change one bit of input and the digest should change unpredictably. That property makes hashes useful for integrity checks, content addressing, and building blocks inside MACs and digital signatures.

Hashing is one-way: you do not “decrypt” a digest. Encoding (like Base64) is reversible. Encryption is reversible with a key. Password storage needs slow, salted password hashes—not a bare SHA-256 of the password. Mixing these categories is a common source of insecure designs.

Experiment with Dockzio’s Hash Generator to compare algorithms on sample inputs. When you need unique identifiers rather than content digests, the UUID Generator is the better tool.

Step-by-step

1. 1. Pick the property you actually need

   Integrity of a file download? A checksum or cryptographic digest helps detect accidental corruption (and, with proper signing, tampering).

   Unique ID for a database row? Prefer a UUID or database-native ID. Hashes of business fields collide when inputs collide and leak information if inputs are guessable.

2. 2. Know common algorithm families

   MD5 and SHA-1 are widely considered broken for collision resistance in security contexts; avoid them for new security designs. SHA-256 and SHA-3 family digests are common general-purpose choices.

   For passwords, use purpose-built algorithms (Argon2, bcrypt, scrypt) via vetted libraries. A fast general hash is the wrong tool.

3. 3. Hash bytes, not “sometimes text”

   Always be explicit about encoding. Hashing the UTF-8 bytes of a string is different from hashing UTF-16 bytes. Hex vs Base64 is only about how you display the digest afterward.

   When comparing digests, normalize hex casing and whitespace. Prefer constant-time comparison APIs when verifying secrets or authentication digests.

4. 4. Use UUIDs when you need identifiers

   UUIDs (especially v4 random) give practically unique IDs without revealing content. They are not checksums of the entity; they are labels.

   Generate IDs with the UUID Generator when scaffolding fixtures, correlating requests, or assigning client-side temporary keys—then store them as opaque identifiers.

5. 5. Connect hashing to tokens and MACs

   HMACs and many JWT signature modes build on hash functions plus keys. Understanding digests helps you read security docs, but production verification still belongs in libraries.

   See JWT Explained when digests show up inside authentication tokens.

Common mistakes

• Using digests as password storage. Fast hashes are GPU-friendly for attackers. Use a password hashing scheme with salt and appropriate work factors.
• Truncating digests carelessly. Shortening a hash increases collision risk. If a protocol requires truncation, follow the spec’s length and security analysis—do not invent your own.
• Assuming identical hashes mean identical trust. Matching digests show identical inputs (for collision-resistant hashes in practice). They do not prove who produced the input unless combined with signatures or secure transport.
• Hashing then Base64-encoding and calling it encryption. That pipeline is still not encryption. Anyone can recompute or ignore it. Keep terminology precise in design reviews.