Hashing Basics: A Beginner's Guide to Secure Password Storage and Data Integrity

By Anurag~28 min readPublished 2025-10-20

Introduction 🌐

In the realm of cybersecurity, protecting sensitive data like passwords and ensuring the integrity of files are critical tasks. On Day 41 of my cybersecurity journey, I explored hashing basics through TryHackMe’s hands-on challenges, diving into the fascinating world of cryptographic hash functions. Hashing transforms data—like a password or file—into a fixed-length string called a hash, acting like a digital fingerprint. Unlike encryption, hashing is a one-way process, meaning you can’t reverse it to retrieve the original data. This makes it essential for secure password storage and verifying data integrity. This beginner-friendly guide breaks down hashing mechanics, secure password practices, cracking techniques, and practical applications, complete with code examples and insights from TryHackMe. Let’s dive into the power of hashing! 🚀

What is Hashing? 🔑

Hashing is a process that takes an input (e.g., a password, file, or message) and produces a fixed-length string of characters, called a hash or digest, using a cryptographic hash function. These functions are designed to be fast, deterministic, and secure, with the following properties:

Deterministic: The same input always produces the same hash.
One-Way: It’s computationally infeasible to reverse a hash to get the original input.
Collision-Resistant: It’s extremely difficult to find two different inputs that produce the same hash.
Sensitive to Changes: Even a tiny change in the input (e.g., adding a space) produces a completely different hash.

Analogy: Think of hashing as a blender that turns any fruit (data) into a smoothie (hash) of a fixed size. No matter how much fruit you put in, you get a standard glass of smoothie, but you can’t unblend it to get the fruit back. If someone tampers with the fruit, the smoothie looks entirely different. 🥤

Hashing is widely used for password storage, data integrity checks, and digital signatures.

Hash Functions: The Building Blocks 🧮

Hash functions are the core of hashing. Common cryptographic hash functions include:

MD5: Produces a 128-bit (32-character) hash. Fast but insecure due to collision vulnerabilities.
SHA-1: Generates a 160-bit (40-character) hash. Deprecated for security-critical applications.
SHA-256: Part of the SHA-2 family, producing a 256-bit (64-character) hash. Widely used and secure.
bcrypt: A password hashing function that incorporates a salt and is deliberately slow to resist brute-force attacks.
Argon2: A memory-hard function, winner of the 2015 Password Hashing Competition, ideal for secure password storage.

Example: Hashing the string “password” with SHA-256 produces: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8. Changing it to “Password” gives a completely different hash.

Through TryHackMe, I learned to recognize these hash formats by their length and prefixes (e.g., bcrypt hashes start with $2b$ ).

Insecure Password Storage: What Not to Do 🚫

Storing passwords insecurely is a common mistake that attackers exploit. Here are risky practices:

Plaintext Storage: Storing passwords as plain text (e.g., “password123”) in a database. If the database is breached, attackers gain immediate access to all passwords.
Fast, Unsalted Hashes: Using fast hash functions like MD5 or SHA-1 without salts. Attackers can precompute hash tables (rainbow tables) to crack them quickly.
Reusing Salts: Using the same salt for all passwords allows attackers to crack multiple hashes simultaneously.

Real-World Case: In 2012, LinkedIn suffered a breach where 6.5 million unsalted SHA-1 password hashes were stolen, leading to widespread password cracking by attackers.

Secure Password Storage: Best Practices 🔒

To store passwords securely, use modern, slow, memory-hard hashing functions with unique salts:

Use bcrypt, scrypt, or Argon2: These functions are designed to be computationally intensive, slowing down brute-force attacks. Argon2 is particularly resistant to GPU-based cracking.
Add a Unique Salt: A salt is a random string added to the password before hashing, ensuring unique hashes even for identical passwords. Salts prevent rainbow table attacks.
Iterate Hashes: Use multiple iterations to increase computation time, making cracking harder.
Store Hashes Securely: Protect the database with access controls and encryption to prevent unauthorized access.

Analogy: A salt is like adding a unique spice to each user’s smoothie (hash). Even if two users have the same password, their hashes are different, making it harder for attackers to crack them in bulk.

Practical Code Example: Password Hashing with bcrypt 🐍

Let’s implement secure password hashing using Python’s bcrypt library, which automatically handles salting and iterations.

import bcrypt

# Hash a password
password = "mySecurePassword123".encode(&apos;utf-8&apos;)
salt = bcrypt.gensalt(rounds=12)  # Generate a random salt with 12 rounds
hashed_password = bcrypt.hashpw(password, salt)

# Verify a password
input_password = "mySecurePassword123".encode(&apos;utf-8&apos;)
is_valid = bcrypt.checkpw(input_password, hashed_password)

print(f"Hashed Password: {hashed_password.decode(&apos;utf-8&apos;)}")
print(f"Password Valid: {is_valid}")

Explanation: This code uses bcrypt to hash a password with a random salt and 12 rounds of iteration. The gensalt function generates a unique salt, and hashpw creates the hash. The checkpw function verifies if an input password matches the stored hash. Install bcrypt with pip install bcrypt.

Output Example: A bcrypt hash looks like $2b$12$randomSaltHerehashedPassword, with the salt and iteration count embedded.

Note: Always use a high number of rounds (e.g., 12–14) to balance security and performance, and store the hash securely in a database.

Recognizing Password Hashes 🔍

Identifying hash types is a key skill in cybersecurity, especially for penetration testing or auditing. Here’s how to recognize common hash formats:

MD5: 32 hexadecimal characters (e.g., d41d8cd98f00b204e9800998ecf8427e).
SHA-1: 40 hexadecimal characters (e.g., da39a3ee5e6b4b0d3255bfef95601890afd80709).
SHA-256: 64 hexadecimal characters (e.g., e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855).
bcrypt: Starts with $2a$ or $2b$ , followed by iteration count and salt (e.g., $2b$12$randomSaltHerehashedPassword).
Argon2: Starts with $argon2i$ or $argon2id$ (e.g., $argon2id$v=19$m=65536,t=3,p=4$randomSalt$hashedPassword).

TryHackMe Insight: I practiced identifying hashes in TryHackMe’s challenges, using tools like hashid or hash-identifier to analyze hash formats.

# Install hashid
pip install hashid

# Analyze a hash
hashid d41d8cd98f00b204e9800998ecf8427e
# Output: Possible Hash: MD5

Password Cracking: The Attacker’s Perspective ⚔️

Understanding how attackers crack hashes helps us design better defenses. Common cracking techniques include:

Dictionary Attacks: Trying common passwords from a wordlist (e.g., “rockyou.txt”).
Brute Force: Testing all possible character combinations, effective for short passwords but slow for longer ones.
Rainbow Tables: Precomputed tables mapping hashes to passwords, defeated by salting.
GPU-Accelerated Cracking: Tools like hashcat use GPUs to test billions of hashes per second.

TryHackMe Insight: I used hashcat in a controlled environment to crack MD5 and SHA-1 hashes, learning how salts and slow algorithms like bcrypt thwart these attacks.

# Example hashcat command to crack an MD5 hash
hashcat -m 0 -a 0 d41d8cd98f00b204e9800998ecf8427e rockyou.txt
# -m 0: MD5 mode, -a 0: Dictionary attack, rockyou.txt: Wordlist

Defense: Use slow hashing functions (bcrypt, Argon2), unique salts, and strong passwords to make cracking impractical.

Hashing for Data Integrity 📜

Hashing ensures data hasn’t been altered by comparing hashes before and after transmission or storage. Common use cases:

File Verification: Software downloads (e.g., Ubuntu ISO) include a hash (e.g., SHA-256) to verify the file’s integrity.
Message Integrity: Hashes in messaging apps ensure messages aren’t tampered with during transit.
Digital Signatures: Combine hashes with asymmetric encryption (e.g., RSA) to verify authenticity and integrity.
HMACs: Hash-based Message Authentication Codes combine a hash with a secret key to ensure both integrity and authenticity.

Example: When downloading Python, you can verify its integrity by comparing the provided SHA-256 hash with one you compute locally.

# Compute SHA-256 hash of a file
sha256sum python-3.11.5.tar.xz
# Output: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Advanced Example: HMACs add a secret key to a hash for stronger security. Here’s a Python HMAC example:

import hmac
import hashlib

message = "Secure message".encode(&apos;utf-8&apos;)
key = "secret-key".encode(&apos;utf-8&apos;)

# Create HMAC
hmac_obj = hmac.new(key, message, hashlib.sha256)
hmac_digest = hmac_obj.hexdigest()

print(f"HMAC: {hmac_digest}")

Practical Uses and Hands-On Learning 🖱️

TryHackMe’s hashing challenges helped me bridge theory and practice. Key exercises included:

Hash Identification: Used hashid to identify hash types like MD5, SHA-1, and bcrypt.
Password Cracking: Practiced cracking weak hashes with hashcat and learned why bcrypt is resistant.
Integrity Checks: Verified file integrity by computing and comparing hashes.
Secure Hashing: Implemented password hashing with bcrypt in a simulated web application.

TryHackMe Room: Check out the Hashing - Crypto 101 room for hands-on practice.

More Practical Examples 🧑‍💻

Here are additional hands-on examples to solidify your understanding of hashing in real-world scenarios:

1. Verifying File Integrity with Node.js 📂

In TryHackMe challenges, I verified file integrity by computing hashes. This Node.js script uses the crypto module to check a file’s SHA-256 hash, similar to verifying a downloaded software package.

const fs = require(&apos;fs&apos;);
const crypto = require(&apos;crypto&apos;);

const filePath = &apos;example.txt&apos;;
const expectedHash = &apos;e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855&apos;;

const hash = crypto.createHash(&apos;sha256&apos;);
const stream = fs.createReadStream(filePath);

stream.on(&apos;data&apos;, (data) => hash.update(data));
stream.on(&apos;end&apos;, () => {
  const computedHash = hash.digest(&apos;hex&apos;);
  console.log(`Computed Hash: ${computedHash}`);
  console.log(`Integrity Check: ${computedHash === expectedHash ? &apos;Passed&apos; : &apos;Failed&apos;}`);
});

Explanation: This script reads a file stream and computes its SHA-256 hash, comparing it to an expected hash. It’s useful for verifying downloads like Linux ISOs. Run with Node.js after creating an example.txt file.

2. Password Hashing with Argon2 🔐

Argon2, the 2015 Password Hashing Competition winner, is ideal for secure password storage. This Node.js example uses the argon2 library to hash and verify passwords, complementing the bcrypt example.

const argon2 = require(&apos;argon2&apos;);

async function hashAndVerify() {
  try {
    // Hash a password
    const password = &apos;mySecurePassword123&apos;;
    const hash = await argon2.hash(password, {
      type: argon2.argon2id,
      memoryCost: 2 ** 16,
      timeCost: 3,
      parallelism: 4,
    });
    console.log(`Hashed Password: ${hash}`);

    // Verify a password
    const isValid = await argon2.verify(hash, password);
    console.log(`Password Valid: ${isValid}`);
  } catch (err) {
    console.error(&apos;Error:&apos;, err);
  }
}

hashAndVerify();

Explanation: This script uses Argon2id (a hybrid of Argon2i and Argon2d) with tuned parameters for memory, time, and parallelism. Install with npm install argon2. It’s resistant to GPU attacks, making it a modern choice for password hashing.

3. HMAC for API Authentication 🌐

HMACs are used in APIs to authenticate requests. This Python example generates an HMAC-SHA256 for a REST API request, simulating a TryHackMe challenge where I secured an API endpoint.

import hmac
import hashlib
import time

api_key = &apos;my-api-key&apos;.encode(&apos;utf-8&apos;)
secret = &apos;my-secret&apos;.encode(&apos;utf-8&apos;)
timestamp = str(int(time.time())).encode(&apos;utf-8&apos;)
request_data = &apos;GET /api/v1/data&apos;.encode(&apos;utf-8&apos;)

# Combine timestamp and request data
message = timestamp + b&apos;:&apos; + request_data

# Generate HMAC
hmac_obj = hmac.new(secret, message, hashlib.sha256)
signature = hmac_obj.hexdigest()

print(f"Authorization Header: APIKey {api_key.decode(&apos;utf-8&apos;)}:{signature}")

Explanation: This script creates an HMAC-SHA256 signature for a GET request, combining a timestamp and request data. The server can verify the signature using the same secret. This is common in APIs like AWS or GitHub.

4. Batch File Integrity Check with Bash 🖥️

In system administration, you might need to verify multiple files’ integrity. This Bash script checks SHA-256 hashes for a set of files, useful for TryHackMe-style integrity challenges.

#!/bin/bash

# Define files and their expected hashes
declare -A expected_hashes=(
  ["file1.txt"]="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  ["file2.txt"]="a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447"
)

for file in "${!expected_hashes[@]}"; do
  if [ -f "$file" ]; then
    computed_hash=$(sha256sum "$file" | cut -d&apos; &apos; -f1)
    if [ "$computed_hash" = "${expected_hashes[$file]}" ]; then
      echo "$file: Integrity Check Passed"
    else
      echo "$file: Integrity Check Failed"
    fi
  else
    echo "$file: File Not Found"
  fi
done

Explanation: This script checks the SHA-256 hashes of multiple files against expected values. Save as verify.sh, make executable with chmod +x verify.sh, and run with ./verify.sh. It’s ideal for batch verification in system administration.

Why Hashing is Secure 🔒

Hashing’s security comes from its one-way nature and collision resistance:

Irreversibility: The one-way property ensures attackers can’t recover the original input from the hash.
Collision Resistance: Modern hash functions like SHA-256 make it nearly impossible to find two inputs with the same hash.
Salting: Unique salts prevent precomputed attacks like rainbow tables.
Slow Algorithms: Functions like bcrypt and Argon2 are deliberately slow, thwarting GPU-based brute-force attacks.

Challenges:

Deprecated Algorithms: MD5 and SHA-1 are vulnerable to collisions and shouldn’t be used for security-critical applications.
Weak Passwords: Even strong hashing can’t protect weak passwords like “123456.”
Implementation Errors: Incorrect salt usage or low iteration counts can weaken hashing.

Practical Tips for Using Hashing 🛠️

To use hashing effectively, follow these best practices:

Use Modern Algorithms: Choose bcrypt, scrypt, or Argon2 for password hashing and SHA-256 or SHA-3 for integrity checks.
Always Salt Passwords: Generate a unique salt per user to prevent rainbow table attacks.
Increase Iterations: Use high iteration counts (e.g., bcrypt with 12–14 rounds) to slow down cracking attempts.
Secure Hash Storage: Protect hashed passwords with database encryption and access controls.
Use HMACs for Authenticity: Combine hashes with secret keys for secure message authentication.
Stay Updated: Avoid deprecated algorithms like MD5 and SHA-1, and monitor advancements in cryptographic research.

Beginner Tip: Experiment with bcrypt or hashcat in a virtual machine to understand hashing and cracking hands-on.

Real-World Applications 🌍

Hashing powers many cybersecurity applications:

Password Storage: Websites like GitHub use bcrypt or Argon2 to store user passwords securely.
File Integrity: Package managers like apt or npm use hashes to verify downloaded files.
Blockchain: Cryptocurrencies like Bitcoin use SHA-256 for transaction verification and mining.
Digital Signatures: Hashes are signed with algorithms like RSA to ensure authenticity in software updates.
Message Authentication: HMACs secure APIs and messaging systems by verifying message integrity and authenticity.

Example: When you install a browser like Firefox, its installer includes a SHA-256 hash to confirm it hasn’t been tampered with.

Why Learn Hashing? 🌟

Mastering hashing is essential for cybersecurity professionals:

Foundational Knowledge: Understand core cryptographic concepts like one-way functions and collision resistance.
Practical Skills: Learn to implement secure password storage and verify data integrity with tools like bcrypt and sha256sum.
Career Relevance: Hashing is critical for roles in web development, penetration testing, and system administration.
Security Mindset: Understanding cracking techniques helps you build stronger defenses.

Conclusion 🎉

Hashing is a cornerstone of cybersecurity, enabling secure password storage and data integrity verification. From protecting user credentials with bcrypt to ensuring software authenticity with SHA-256, hashing is everywhere in our digital world. Through TryHackMe, I learned to identify hashes, implement secure hashing, and understand cracking techniques, bridging theory and practice. By mastering hashing concepts—functions, salting, slow algorithms, and integrity checks—you’re equipping yourself with vital skills to build a safer internet.

Ready to dive deeper? Experiment with bcrypt in Python, try cracking hashes with hashcat in a safe environment, and explore TryHackMe’s cryptography challenges. Let’s secure the digital world together! 🚀