What is password hashing? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

Quest开发者_Python百科ions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist

Closed 9 years ago.

Improve this question

What does it mean to hash a password?

---

Definition:
Hashing is the application of a function f() to a variable sized input to produce a constant sized output.

A => f() => X
B => f() => Y
C => f() => Z

A hash is also a one-way function which means that there isn't a function to reverse or undo a hash. As well re-applying the hash f(f(x)) isn't going to product x again.

The Details:

A hash function can be as simple as "add 13 to the input" or complex like a Cryptographic Hash such as MD5 or SHA1. There are many things that constitute a good hash function like:

• Low Cost: Easy to compute
• Deterministic: if I hash the input a multiple times, I am going to get the same output each time
• Uniformity: The input will be evenly distributed among the possible outputs. This falls in line with something called the Pigeonhole Principle. Since there are a limited number of outputs we want f() to place those outputs evenly instead of in the same bucket. When two inputs compute to the same output this is known as a collision. It's a good thing for a hash function to produce fewer collisions.

Hashing applied to Passwords:

The hashing of passwords is the same process as described above, however it comes with some special considerations. Many of the properties that make up a good hash function are not beneficial when it comes to passwords.

Take for example determinism, because hashes produce a deterministic result when two people use the same password the hash is going to look the same in the password store. This is a bad thing! However this is mitigated by something called a salt.

Uniformity on the other hand is beneficial because the desire is for the algorithm to limit collisions.

Because a hash is One-Way means the input cannot be determined from the output, which is why hashing is great for passwords!

---

takes a block of data and returns a string such that you can't get your original block of data back.

Wikipedia Article

Hashing a password will take a clear text string and perform an algorithm on it (depending on the hash type) to get a completely different value. This value will be the same every time, so you can store the hashed password in a database and check the user's entered password against the hash.

This prevents you from storing the cleartext passwords in the database (bad idea).

Here is a list of hash functions.

---

A hash is simply a one-way function, that will take a string or data source and create an encrypted looking string.

There are various hashing algorithms the most popular is MD5, but there are many others. Many experts in the industry are using the SHA256 algorithm for better security.

MD5 Hash for the words:

password is 22e5ab5743ea52caf34abcc02c0f161d

PASSWORD is 319f4d26e3c536b5dd871bb2c52e3178

The character length of the result will be the same regardless of how many characters you try to hash. Hashes are commonly used to store passwords to prevent them from being viewed.