A field guide to
Hashing & Cryptography
A personal reference for turning data into fingerprints, secrets, and proofs — what hash functions guarantee, how to shorten a string to fit a limit, how to store passwords, how to sign and encrypt. Every diagram runs real SHA-256, HMAC, and AES in your browser, so you can poke at the actual outputs.
Which tool do I need?
| I want to… | Use | Read |
|---|---|---|
| Shorten a long string to a fixed-length key (e.g. under 40 chars) | SHA-256 → first 16 bytes → hex (32) or Base64url (22) | Shortening Strings |
| Store user passwords | Argon2id or bcrypt (salt built in) | Salting & Passwords |
| Store API keys / reset tokens I issued | SHA-256 of the random token | HMAC & Tokens |
| Prove a webhook / cookie / URL came from me | HMAC-SHA256 + constant-time compare | HMAC & Tokens |
| Check a file wasn't corrupted or changed | SHA-256 (CRC32C/xxHash if no attacker) | Integrity & Dedup |
| Spread keys across servers or buckets | MurmurHash/xxHash + consistent hashing | Sharding & Bloom Filters |
| Keep data secret but get it back later | AES-256-GCM, key in a KMS | Symmetric Encryption |
| Let anyone verify I signed something | Ed25519 / ECDSA signature | Public-Key Crypto |
| Send bytes through a text-only channel | Base64url or hex (not security!) | Hash vs Encrypt vs Encode |
Fundamentals
What a Hash Function Is
A function that maps input of any size to a fixed-size fingerprint — deterministic, fast, and (for cryptographic hashes) impossible to reverse or collide on purpose.
Hashing vs. Encryption vs. Encoding
Three transformations that all turn readable data into gibberish — but only one hides it with a key, only one is irreversible, and one provides no security at all.
Choosing a Hash Algorithm
MD5, SHA-1, SHA-256, SHA-3, BLAKE3, xxHash, bcrypt, Argon2 — which family each belongs to, which are broken, and which to reach for by default.
Practical Hashing
Shortening Strings with Hashes
Turn a string of any length into a short, fixed-length, deterministic key — the right algorithm, encoding, and truncation for a length limit, and the collision math that tells you whether it's safe.
Hash Tables, Sharding & Bloom Filters
Using hashes to decide where things go — buckets in memory, partitions across machines, and probabilistic set membership — and why hash(key) % N falls apart when N changes.
Integrity, Dedup & Content Addressing
Using a hash as proof that data hasn't changed — checksums, ETags, deduplication, Merkle trees, and systems like git and Docker where the hash of the content is its name.
Passwords & Authentication
Salting & Password Hashing
Why passwords need a unique random salt and a deliberately slow hash — rainbow tables, peppers, work factors, and the code for doing it right with Argon2id and bcrypt.
HMAC & Signed Tokens
A hash with a secret key mixed in — proving a message came from someone holding the key and wasn't altered. Behind webhook signatures, JWTs, signed URLs, session cookies, and API request signing.
Cryptography
Symmetric Encryption
One shared key to encrypt and decrypt — AES-GCM and ChaCha20-Poly1305, why the nonce must never repeat, why you need authenticated encryption, and where the key should live.
Public-Key Cryptography & Signatures
Key pairs where one key is public — encrypting to someone you've never met, signing so anyone can verify, and how TLS, certificates, and JWTs combine hashes, signatures, and symmetric keys.