# What Is Hash Function (cryptographic hash function)?

> A cryptographic hash function maps input of any length to a fixed-size digest in a way that is infeasible to reverse or to make two inputs collide.

Source: https://ssl.sh/glossary/hash-function/
Last updated: 2026-11-10

A cryptographic hash function takes data of any size and returns a fixed-size digest, for example 256 bits for [SHA-256](https://ssl.sh/glossary/sha-256/). It must be preimage resistant (given a digest, you cannot find an input that produces it), second-preimage resistant and collision resistant (you cannot find two inputs with the same digest), and any change to the input should produce an unrelated digest. Current choices include SHA-256, SHA-384 and SHA-3; MD5 and [SHA-1](https://ssl.sh/glossary/sha-1/) are broken for collision resistance.

## Why it matters
Hashes sit underneath almost every part of TLS and PKI. A [digital signature](https://ssl.sh/glossary/digital-signature/) on a certificate is a signature over a hash of its contents, so a practical collision attack can let an attacker transfer a CA's signature to a forged certificate; researchers demonstrated exactly that with MD5 in 2008 by creating a rogue CA certificate. Hashes also produce certificate fingerprints, drive HMAC and HKDF key derivation, protect the handshake transcript in Finished messages, and build the Merkle trees of Certificate Transparency logs.

## Example
A one-character change produces a completely different digest:

```bash
printf 'example.com' | openssl dgst -sha256
printf 'example.con' | openssl dgst -sha256
openssl x509 -in example.com.crt -noout -fingerprint -sha256
```

## Common misconceptions
- **"Hashing is a form of encryption."** There is no key and no way to decrypt. For storing passwords, use slow dedicated functions such as bcrypt or Argon2 rather than a fast hash.
- **"A matching fingerprint proves a certificate is trusted."** A fingerprint only identifies one exact certificate; trust comes from validating its chain.
- **"Any 128-bit-or-longer hash is fine."** MD5 is 128 bits and SHA-1 is 160 bits, yet both have practical collisions; the algorithm matters, not only the output length.

## Related terms

- [SHA-256](https://ssl.sh/zh/glossary/sha-256/): SHA-256 是 SHA-2 哈希家族中输出 256 位摘要的成员，由 NIST FIPS 180-4 规定，是当今 TLS 证书签名和指纹的标准哈希算法。
- [SHA-1](https://ssl.sh/zh/glossary/sha-1/): SHA-1 是 1995 年发布的 160 位哈希函数，已出现实际可行的碰撞攻击，公开信任的 TLS 证书早已不再允许使用它签名。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。
- [证书指纹](https://ssl.sh/zh/glossary/certificate-fingerprint/): 证书指纹是对证书 DER 编码计算出的哈希值（通常用 SHA-256），用来唯一标识一张证书，它本身并不存储在证书里。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。