Hash Functions Explained: SHA-256, Fingerprints, and Password Storage

One-way fingerprints for files and passwords — how hashing works, why MD5 is dead, and how salting defeats rainbow tables.

KPM Editorial · Developer · 2025-10-06 · 6 min read

A Fingerprint for Data

A cryptographic hash takes any input — a novel, a photo, a password — and produces a fixed-length fingerprint. Change one bit of input and the fingerprint avalanches into something unrecognizable. Crucially, it is one-way: you cannot reconstruct the novel from its hash.

What Hashes Are Good For

• Integrity checks — download pages publish SHA-256 sums; mismatched hash means corrupted or tampered file.
• Password storage — servers store hashes, so a breach leaks no usable passwords (if done right).
• Deduplication — identical files share a hash; cloud drives use this to store one copy.
• Git & blockchains — every commit and block is hash-linked to its parent.

MD5 Is Dead, SHA-1 Is Dying

MD5 collisions can be manufactured in seconds, and SHA-1 fell to a practical attack in 2017. For any security purpose today, use SHA-256 or SHA-512 at minimum — both run natively in your browser via the Web Crypto API.

Salts Defeat Rainbow Tables

Attackers precompute hashes of common passwords ("rainbow tables"). A unique random salt per password makes those tables useless. Better still, use memory-hard functions like bcrypt, scrypt, or Argon2 that make each guess expensive — plain SHA-256 is too fast for password storage.

Hash Anything, Right Here

KPM's Hash Generator Suite computes SHA-256, SHA-512, MD5, and HMAC digests as you type — locally, so the text you fingerprint never traverses the network.