04_Hashing — Hashing — one-way, keyless, and constantly misunderstood¶
Level: 101 → 201 · for anyone starting from zero
A hash takes any input and produces a fixed-size digest. It has no key and no inverse, which makes it the piece most often mistaken for encryption — "the password is encrypted in the database" almost always means hashed, and the difference decides what a breach costs.
Three properties are claimed for a cryptographic hash, and they are not the same claim:
| Property | An attacker cannot… | Broken for MD5? | SHA-1? |
|---|---|---|---|
| Preimage | find any input with a given digest | no | no |
| Second preimage | find a different input matching a given one | no | no |
| Collision | find any two inputs that match | yes, trivially | yes, since 2017 |
Collision resistance is the first to fall and the one most protocols actually need — which is why "MD5 is broken" and "MD5 still resists preimages" are both true and are not a contradiction.
The pages¶
| # | Page | The question it answers | Status |
|---|---|---|---|
| 1 | A hash is not encryption | What does a hash promise, and what can never be undone? | written, 2026-09-07 |
Every page above is a plan until its row says written; see ROADMAP.md.
The through-line¶
A hash is a fingerprint, not a safe. It proves two things are the same; it hides nothing on its own, because anybody can hash a guess.