Cryptography basics

The Cornerstone of Modern Cryptography: the Hash Function “Avalanche Effect”

A hash function is a data meat-grinder: feed it anything — one word, a novel, a whole disk — and out comes a fixed-length fingerprint. SHA-256 always outputs 256 bits, i.e. 64 hex characters. Two personality traits make it indispensable.

Trait 1: one-way — you can’t un-grind the sausage

Going from input to hash takes microseconds; going back has no shortcut — you can only guess inputs one by one. That is one-wayness (preimage resistance). Finding two different inputs with the same hash is also practically impossible (collision resistance).

Trait 2: avalanche — change one letter, change everything

With a good hash, flipping a single input bit flips about half of the output bits; the result looks like an unrelated random number. That is the avalanche effect: one pebble at the top, a whole avalanche at the bottom.

Real values (checked with sha256sum):

password123 →

Password123 →

The inputs differ only in the case of one letter — in ASCII, p (0x70) and P (0x50) differ by a single bit. Yet 117 of 256 bits differ (about 45.7%), and 61 of 64 characters don’t match. How similar two hashes look tells you nothing about how similar the inputs were.

Why this matters for your passwords

Well-built systems never store your password in plaintext — only its hash. When you log in, the system hashes what you typed and compares it with the stored value. Steal the database and you get fingerprints, not passwords.

Plain SHA-256 isn’t enough, though:

• Salting: each user gets a random string mixed into the password before hashing, so two people using password123 get different stored hashes, and precomputed “rainbow tables” become useless.
• Slow hashes: SHA-256 is fast — a GPU can try billions per second. Password storage should use deliberately slow, memory-hard algorithms such as bcrypt, scrypt or Argon2, so every guess costs real work.

No hash can save a white password, though: password123 sits near the top of every leak dictionary. Use a grey password.

Try it: watch the avalanche yourself