Hash Lab

What is a hash?

A hash, or digest, is the result of applying a hash function to data. For a given algorithm, its size is fixed and the same input produces the same digest. A cryptographic hash is used to check integrity, among other purposes; it cannot be decrypted like an encrypted message.

Hash functions

A hash function turns data of any size into a fixed-size digest: 128 bits for MD5, 256 bits for SHA-256. The same input always gives the same digest, and changing a single bit changes the result completely. A cryptographic hash adds three properties: it must be infeasible in practice to recover the input (preimage resistance), to find another input with the same digest (second preimage resistance) and to craft two inputs that collide.

HMAC (RFC 2104) combines a hash function with a secret key. It proves that a message comes from someone who knows the key and that it has not been altered. Webhook signatures, HS256 JWTs and many APIs rely on it.

The families on offer

SHA-2 (SHA-224 to SHA-512) remains the default choice. SHA-3, standardised by NIST in 2015 (FIPS 202), uses a different construction, the Keccak sponge. Keccak-256 is the pre-standard variant with different padding: Ethereum uses it, and its digests do not match SHA3-256. BLAKE2b and BLAKE3 are faster than SHA-2 in software; BLAKE3 is popular for verifying large files. CRC32 and xxHash64 are checksums: they catch accidental corruption but are trivial to forge.

The work is done by hash-wasm, which compiles the reference implementation of each function to WebAssembly. Our automated tests check the results against published test vectors and against OpenSSL.

Why MD5 and SHA-1 are broken

MD5 collisions have taken seconds to compute since 2005. They were used to forge a certificate authority in 2008, then the Microsoft certificate abused by the Flame malware in 2012. For SHA-1, Google and CWI published two different PDFs with the same digest in 2017 (SHAttered), and a chosen-prefix collision followed in 2020. Both remain acceptable for spotting accidental corruption, but not for a signature, a certificate or any check against an adversary. Use SHA-256, SHA-512, SHA-3 or BLAKE3.

Passwords are a special case

A fast hash function is a poor choice for storing passwords: a GPU tries tens of billions of MD5 or NTLM hashes per second. A salt, a random value unique to each account, defeats precomputed tables and forces each hash to be attacked separately, but it does not slow the computation down.

Dedicated functions are deliberately slow and tunable. Argon2id is the current OWASP recommendation; scrypt and bcrypt remain acceptable, and so does PBKDF2 with a high iteration count where FIPS compliance requires it. Tune the cost so that one verification takes a few tens of milliseconds on your server.

The limits of identification

A hash does not say which algorithm produced it. Prefixed formats ($2b$, $6$, $krb5tgs$) are identified without ambiguity. A bare hex string only reveals its length: 64 characters fit SHA-256 as well as SHA3-256, BLAKE3 or a salted SHA-256. Always cross-check with the source: a MySQL database, an /etc/shadow file, an NTDS dump or a Responder capture tell you the format far better than the string alone.