Skip to content
Back to home
2025-10-06Cryptography

Hashing in Cybersecurity

Why hashing is the silent protector of digital trust — how it secures passwords, powers digital signatures, underpins Windows credential storage, and why hash collisions matter.

Part 3 of 3 — Cryptography
← Previous

The Silent Protector of Digital Trust

Introduction

Hashing is an important concept for securing integrity in the digital world. Every time you log in to a system by entering your credentials, sign a digital document, or verify an app download, there's an invisible process quietly at work called hashing. It's one of the pillars that hold up cybersecurity.

Encryption is reversible and protects confidentiality; hashing is one-way and protects integrity. It makes sure your data stays honest — it guarantees integrity, which means what you sent or stored is exactly what is received or retrieved, with zero tampering.

What Hashing Really Does

Before diving into the process of hashing, we first need to understand what a hash actually is. A hash is the digital fingerprint of data, consisting of alphanumeric characters. Hashes always have a fixed length — even if we hashed a password of 100 characters, the hash length would be the same as for a password of 4 letters. Importantly, hashes are irreversible.

So what is hashing? Hashing is a process of converting any piece of information — whether a password, a file, or a full message — into a unique fixed-length string of characters. This output is called a hash value, or digest.

Example:

  • Input: "CyberLion" → MD5 Hash: 2a5a9ec18b7bccbac8d6d346a35c5750
  • Input: "Cyberlion" → MD5 Hash: b3f57e154c53d4b183c36db60de02d9e

That one uppercase letter made a completely different hash. This sensitivity is what makes hashing so powerful for detecting changes.

Why Hashes Cannot Be Reversed

A crucial part of hashing is that it's a one-way process. You can hash something, but you cannot reverse it to get the original data back. That's why it's ideal for password storage.

Even if an attacker steals hashed data, they cannot directly see the original text. Though with weak algorithms, they can still brute-force it or use rainbow tables — so choosing the right algorithm matters a great deal.

Password Integrity

Every time you sign up for an online account, your password is never stored as plain text. It is stored as a hash instead.

The process is simple:

  1. You type your password.
  2. The website hashes it (say, using SHA-256).
  3. It stores only that hash value in the database.

Next time you log in, the system hashes your entered password again and compares the two hashes. If they match, you're verified.

Now imagine a hacker breaks into that database — all they'd see are gibberish strings. But hackers are clever: precomputed hash tables (rainbow tables) are used to guess possible passwords.

To counter that, systems use salting, which adds random data to your password before hashing.

Example:

  • Password: "Tiger123"
  • Salt: "9xk!"
  • Hashed Result: a34f02dc5f...

Even if two users have the same password, their hashes will be completely different because of the unique salt.

Digital Signatures

Digital signatures rely heavily on hashing too — they ensure that data has not been tampered with. Here's the process:

  1. The sender hashes the document.
  2. They encrypt that hash with their private key (remember asymmetric encryption) to create the digital signature.
  3. The receiver decrypts the signature using the public key and re-hashes the original document.
  4. If both hashes match, the document is verified.

So hashing guarantees integrity (no tampering) and authenticity (it really came from the sender). This process powers secure communication, software updates, and even blockchain transactions.

Inside Windows: NTLM Hashes and Credential Storage

Windows systems use hashing internally. Windows does not store your actual password — instead, it derives an NTLM hash (based on the MD4 algorithm) from your password and stores it in the SAM database for local authentication.

When you log in, Windows hashes the password you type and compares it to the stored NTLM hash. If they match, access is granted.

But the problem? Attackers can dump these hashes using tools like Mimikatz or SecretsDump. That's why Windows admins secure these hashes using techniques like LSA protection, Credential Guard, and limiting local admin reuse.

Hash Collisions

Even though hash functions are designed to be unique, sometimes different inputs can produce the same hash. This is called a collision, and it happens because hash output size is limited.

Older algorithms like MD5 and SHA-1 have been proven vulnerable to collisions, meaning two different files can share the same hash. This is dangerous for verifying integrity — imagine downloading a malicious file that has the same hash as a legitimate one.

That's why modern cybersecurity relies on stronger algorithms like SHA-256, SHA-3, and bcrypt.

Real-World Use Cases of Hashing

Let's see how hashing pops up everywhere:

  • Password storage – Every authentication system uses hashing.
  • Digital forensics – Investigators hash files to prove evidence was not altered.
  • Malware detection – AV tools compare file hashes against known malicious ones.
  • Blockchain – Every block's integrity depends on hashes.
  • Software integrity – Developers provide checksum hashes so users can verify that downloaded files weren't tampered with.

Hashing is everywhere, silently running in the background.

Conclusion

Hashing does not hide secrets, and it does not encrypt messages. But it gives us something just as important — integrity.

From your Windows login to digital signatures, from blockchain blocks to password databases, hashing ensures that what you see is what was truly sent.