Hardi

Posted on Oct 28

Hash Generator: The Complete Guide to Cryptographic Hashing

#algorithms #programming #javascript #security

Hashing is the foundation of modern security, data integrity, and efficient data structures. From password storage to blockchain, file verification to caching strategies, cryptographic hash functions are everywhere in software development. Let's explore how to generate, use, and optimize hashes in production systems.

Why Hash Functions Matter

The Core Problem

// The fundamental challenge in software
const securityProblems = {
  passwordStorage: 'Never store passwords in plain text',
  dataIntegrity: 'How do you verify data hasn\'t been tampered with?',
  caching: 'How do you create efficient cache keys?',
  deduplication: 'How do you quickly identify identical content?',
  digitalSignatures: 'How do you prove authenticity?'
};

// Hash functions solve all of these
const hashSolution = {
  properties: [
    'Deterministic - Same input = same hash',
    'Fast - Process large data quickly',
    'One-way - Cannot reverse hash to input',
    'Avalanche effect - Small change = completely different hash',
    'Collision resistant - Nearly impossible to find two inputs with same hash'
  ],

  applications: [
    'Password storage (bcrypt, Argon2)',
    'File integrity (checksums, digital signatures)',
    'Data deduplication (git, backup systems)',
    'Cache keys (Redis, Memcached)',
    'Blockchain (Bitcoin, Ethereum)',
    'Message authentication (HMAC)',
    'Content addressing (IPFS, torrents)'
  ]
};

console.log('Hashes are the backbone of secure systems');

Real-World Impact

// Before hashing: Security nightmare
const badPasswordStorage = {
  username: 'john@example.com',
  password: 'MyPassword123'  // NEVER DO THIS!
};

// Problem: Database breach = all passwords compromised
// 2013 Adobe breach: 150 million plain text passwords stolen

// With hashing: Secure password storage
const crypto = require('crypto');
const bcrypt = require('bcrypt');

async function securePasswordStorage(password) {
  // Use bcrypt with salt rounds
  const saltRounds = 12;
  const hash = await bcrypt.hash(password, saltRounds);

  return {
    username: 'john@example.com',
    passwordHash: hash  // Stored: $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW
  };
}

// Result: Even with database breach, passwords are safe
// Attacker gets hash, but cannot reverse it to password

Hash Algorithm Deep Dive

MD5 (Legacy - Don't Use for Security)

const crypto = require('crypto');

function md5Hash(data) {
  return crypto
    .createHash('md5')
    .update(data)
    .digest('hex');
}

const hash = md5Hash('Hello World');
console.log(hash); // 'b10a8db164e0754105b7a99be72e3fe5'

// Properties:
// - Fast (good for checksums)
// - 128-bit output (32 hex characters)
// - BROKEN for security (collisions found)

// Still valid for:
// ✓ File checksums (non-adversarial)
// ✓ ETags in HTTP
// ✓ Database keys
// ✗ Passwords (NEVER!)
// ✗ Digital signatures (NEVER!)
// ✗ Security-critical applications

console.log('MD5 is fast but insecure - use only for checksums');

SHA-1 (Deprecated for Security)

function sha1Hash(data) {
  return crypto
    .createHash('sha1')
    .update(data)
    .digest('hex');
}

const hash = sha1Hash('Hello World');
console.log(hash); // '0a4d55a8d778e5022fab701977c5d840bbc486d0'

// Properties:
// - 160-bit output (40 hex characters)
// - Git still uses it (git commit hashes)
// - Collision found in 2017 (SHAttered attack)

// Still valid for:
// ✓ Git (legacy, moving to SHA-256)
// ✓ Non-security checksums
// ✗ New security applications (use SHA-256+)

console.log('SHA-1 deprecated for security - use SHA-256+');

SHA-256 (Current Standard)

function sha256Hash(data) {
  return crypto
    .createHash('sha256')
    .update(data)
    .digest('hex');
}

const hash = sha256Hash('Hello World');
console.log(hash); 
// 'a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e'

// Properties:
// - 256-bit output (64 hex characters)
// - Industry standard (Bitcoin, TLS, etc.)
// - No known attacks
// - Perfect balance of security and speed

// Use for:
// ✓ File integrity verification
// ✓ Digital signatures
// ✓ Blockchain
// ✓ API request signing
// ✓ Content addressing
// ✓ Cache keys

console.log('SHA-256 is the gold standard for 2024');

SHA-512 (Extra Security)

function sha512Hash(data) {
  return crypto
    .createHash('sha512')
    .update(data)
    .digest('hex');
}

const hash = sha512Hash('Hello World');
console.log(hash);
// '2c74fd17edafd80e8447b0d46741ee243b7eb74dd2149a0ab1b9246fb30382f27e853d8585719e0e67cbda0daa8f51671064615d645ae27acb15bfb1447f459b'

// Properties:
// - 512-bit output (128 hex characters)
// - More secure than SHA-256
// - Slower than SHA-256
// - Overkill for most applications

// Use for:
// ✓ High-security applications
// ✓ Government/military systems
// ✓ Long-term security (decades)
// ~ Standard applications (SHA-256 is fine)

console.log('SHA-512 for maximum security');

SHA-3 (Newest Standard)

function sha3Hash(data) {
  return crypto
    .createHash('sha3-256')
    .update(data)
    .digest('hex');
}

const hash = sha3Hash('Hello World');
console.log(hash);
// 'e167f68d6563d75bb25f3aa49c29ef612d41352dc00606de7cbd630bb2665f51'

// Properties:
// - Different algorithm family than SHA-2
// - Not faster, but more resistant to certain attacks
// - NIST standard (2015)
// - Future-proof

// Use for:
// ✓ Long-term projects
// ✓ Regulatory compliance
// ✓ Defense in depth
// ~ Stick with SHA-256 unless required

console.log('SHA-3 is future-proof but SHA-256 is still king');

BLAKE2 (Fast and Secure)

// Note: Requires blake2 package
const { blake2b } = require('blake2');

function blake2Hash(data) {
  const hash = blake2b(32); // 32 bytes = 256 bits
  hash.update(Buffer.from(data));
  return hash.digest('hex');
}

const hash = blake2Hash('Hello World');
console.log(hash);

// Properties:
// - Faster than MD5, SHA-1, SHA-2
// - More secure than SHA-2
// - Used in Argon2 (password hashing)
// - Not as widely adopted as SHA-256

// Use for:
// ✓ Performance-critical applications
// ✓ When you control both ends
// ✓ File checksums
// ~ Compatibility matters (use SHA-256)

console.log('BLAKE2 is faster and more secure, but less standard');

Implementation Methods

1. Node.js Built-in Crypto

const crypto = require('crypto');

// Basic hash generation
function generateHash(algorithm, data) {
  return crypto
    .createHash(algorithm)
    .update(data)
    .digest('hex');
}

// Support multiple algorithms
const algorithms = ['md5', 'sha1', 'sha256', 'sha512', 'sha3-256'];

const input = 'Hello World';
console.log('\n=== Hash Comparison ===\n');

algorithms.forEach(algo => {
  const hash = generateHash(algo, input);
  console.log(`${algo.toUpperCase().padEnd(10)}: ${hash}`);
  console.log(`Length: ${hash.length} characters\n`);
});

// Hash from file
async function hashFile(filePath, algorithm = 'sha256') {
  const hash = crypto.createHash(algorithm);
  const stream = fs.createReadStream(filePath);

  return new Promise((resolve, reject) => {
    stream.on('data', chunk => hash.update(chunk));
    stream.on('end', () => resolve(hash.digest('hex')));
    stream.on('error', reject);
  });
}

// Usage
const fileHash = await hashFile('document.pdf');
console.log('File SHA-256:', fileHash);

// Hash from Buffer
function hashBuffer(buffer, algorithm = 'sha256') {
  return crypto
    .createHash(algorithm)
    .update(buffer)
    .digest('hex');
}

// Base64 output instead of hex
function hashBase64(data, algorithm = 'sha256') {
  return crypto
    .createHash(algorithm)
    .update(data)
    .digest('base64');
}

2. HMAC (Hash-based Message Authentication)

// HMAC adds a secret key for authentication
function generateHMAC(data, secret, algorithm = 'sha256') {
  return crypto
    .createHmac(algorithm, secret)
    .update(data)
    .digest('hex');
}

// Use for API request signing
const apiKey = 'your-secret-key';
const requestBody = JSON.stringify({ action: 'transfer', amount: 100 });
const signature = generateHMAC(requestBody, apiKey);

console.log('Request Signature:', signature);

// Verify HMAC
function verifyHMAC(data, signature, secret, algorithm = 'sha256') {
  const expectedSignature = generateHMAC(data, secret, algorithm);

  // Use timing-safe comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// API request verification
app.post('/api/webhook', (req, res) => {
  const signature = req.headers['x-signature'];
  const body = JSON.stringify(req.body);

  if (!verifyHMAC(body, signature, apiKey)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process authenticated request
  res.json({ success: true });
});

3. Password Hashing (bcrypt)

const bcrypt = require('bcrypt');

// NEVER use fast hashes for passwords!
async function hashPassword(password) {
  const saltRounds = 12;  // Cost factor (higher = slower = more secure)
  const hash = await bcrypt.hash(password, saltRounds);

  console.log('Password hash:', hash);
  // Example: $2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW

  return hash;
}

// Verify password
async function verifyPassword(password, hash) {
  const match = await bcrypt.compare(password, hash);
  return match;
}

// Usage in authentication
app.post('/api/login', async (req, res) => {
  const { email, password } = req.body;

  // Get user from database
  const user = await db.query(
    'SELECT * FROM users WHERE email = $1',
    [email]
  );

  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Verify password
  const isValid = await verifyPassword(password, user.password_hash);

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Generate session token
  const sessionToken = crypto.randomBytes(32).toString('hex');

  res.json({ success: true, token: sessionToken });
});

// Password hashing benchmark
async function benchmarkPasswordHashing() {
  const password = 'MySecurePassword123!';

  for (let rounds = 10; rounds <= 14; rounds++) {
    const start = Date.now();
    await bcrypt.hash(password, rounds);
    const duration = Date.now() - start;

    console.log(`Salt rounds ${rounds}: ${duration}ms`);
  }
}

// Typical results:
// Salt rounds 10: 65ms   - Fast, minimum acceptable
// Salt rounds 12: 250ms  - Recommended for 2024
// Salt rounds 14: 1000ms - High security, slower UX

4. Express API for Hash Generation

const express = require('express');
const crypto = require('crypto');
const multer = require('multer');

const app = express();
app.use(express.json());
const upload = multer({ storage: multer.memoryStorage() });

// Hash text input
app.post('/api/hash', (req, res) => {
  const { data, algorithm = 'sha256' } = req.body;

  if (!data) {
    return res.status(400).json({ error: 'Data required' });
  }

  const supportedAlgorithms = ['md5', 'sha1', 'sha256', 'sha512', 'sha3-256'];

  if (!supportedAlgorithms.includes(algorithm)) {
    return res.status(400).json({ 
      error: 'Unsupported algorithm',
      supported: supportedAlgorithms
    });
  }

  const hash = crypto
    .createHash(algorithm)
    .update(data)
    .digest('hex');

  res.json({
    algorithm,
    input: data.substring(0, 100),  // First 100 chars
    hash,
    length: hash.length
  });
});

// Hash file upload
app.post('/api/hash/file', upload.single('file'), (req, res) => {
  if (!req.file) {
    return res.status(400).json({ error: 'File required' });
  }

  const algorithm = req.body.algorithm || 'sha256';

  const hash = crypto
    .createHash(algorithm)
    .update(req.file.buffer)
    .digest('hex');

  res.json({
    filename: req.file.originalname,
    size: req.file.size,
    algorithm,
    hash
  });
});

// Generate multiple hashes
app.post('/api/hash/multi', (req, res) => {
  const { data } = req.body;

  if (!data) {
    return res.status(400).json({ error: 'Data required' });
  }

  const algorithms = ['md5', 'sha1', 'sha256', 'sha512'];
  const hashes = {};

  algorithms.forEach(algo => {
    hashes[algo] = crypto
      .createHash(algo)
      .update(data)
      .digest('hex');
  });

  res.json({
    input: data.substring(0, 100),
    hashes
  });
});

// Verify hash
app.post('/api/hash/verify', (req, res) => {
  const { data, hash, algorithm = 'sha256' } = req.body;

  const computedHash = crypto
    .createHash(algorithm)
    .update(data)
    .digest('hex');

  const matches = computedHash === hash;

  res.json({
    matches,
    expected: hash,
    computed: computedHash,
    algorithm
  });
});

app.listen(3000, () => {
  console.log('Hash API running on port 3000');
  console.log('POST /api/hash - Hash text');
  console.log('POST /api/hash/file - Hash file');
  console.log('POST /api/hash/multi - Multiple algorithms');
  console.log('POST /api/hash/verify - Verify hash');
});

5. Python Implementation

import hashlib
import hmac

# Basic hash generation
def generate_hash(data, algorithm='sha256'):
    """Generate hash using specified algorithm"""

    # Convert string to bytes
    data_bytes = data.encode('utf-8')

    # Create hash object
    if algorithm == 'md5':
        hash_obj = hashlib.md5(data_bytes)
    elif algorithm == 'sha1':
        hash_obj = hashlib.sha1(data_bytes)
    elif algorithm == 'sha256':
        hash_obj = hashlib.sha256(data_bytes)
    elif algorithm == 'sha512':
        hash_obj = hashlib.sha512(data_bytes)
    elif algorithm == 'sha3_256':
        hash_obj = hashlib.sha3_256(data_bytes)
    else:
        raise ValueError(f'Unsupported algorithm: {algorithm}')

    return hash_obj.hexdigest()

# Usage
text = "Hello World"
print(f"SHA-256: {generate_hash(text, 'sha256')}")

# Hash file
def hash_file(filepath, algorithm='sha256'):
    """Hash file contents"""
    hash_obj = hashlib.new(algorithm)

    with open(filepath, 'rb') as f:
        # Read file in chunks for large files
        for chunk in iter(lambda: f.read(4096), b''):
            hash_obj.update(chunk)

    return hash_obj.hexdigest()

# HMAC generation
def generate_hmac(data, secret, algorithm='sha256'):
    """Generate HMAC with secret key"""
    data_bytes = data.encode('utf-8')
    secret_bytes = secret.encode('utf-8')

    hmac_obj = hmac.new(secret_bytes, data_bytes, algorithm)
    return hmac_obj.hexdigest()

# Verify HMAC
def verify_hmac(data, signature, secret, algorithm='sha256'):
    """Verify HMAC signature"""
    expected = generate_hmac(data, secret, algorithm)
    return hmac.compare_digest(expected, signature)

# Compare multiple algorithms
def compare_algorithms(text):
    algorithms = ['md5', 'sha1', 'sha256', 'sha512']

    print(f"\nHashing: '{text}'\n")

    for algo in algorithms:
        hash_value = generate_hash(text, algo)
        print(f"{algo.upper():<10}: {hash_value}")
        print(f"Length: {len(hash_value)} characters\n")

compare_algorithms("Hello World")

6. Quick Online Hash Generation

For rapid testing, debugging, or verifying file integrity, using a hash generator can quickly compute hashes without writing code. This is particularly useful when:

Verifying downloads: Check file integrity after download
Comparing files: Quickly verify if two files are identical
Testing APIs: Generate HMAC signatures for testing
Learning: Understand how different algorithms produce different outputs

For production systems, integrate hash generation directly into your codebase for optimal security and performance.

Real-World Use Cases

1. File Integrity Verification

// Verify downloaded file integrity
const fs = require('fs').promises;
const crypto = require('crypto');

async function verifyFileIntegrity(filePath, expectedHash, algorithm = 'sha256') {
  console.log(`\nVerifying: ${filePath}`);
  console.log(`Expected ${algorithm.toUpperCase()}: ${expectedHash}`);

  // Compute file hash
  const fileBuffer = await fs.readFile(filePath);
  const computedHash = crypto
    .createHash(algorithm)
    .update(fileBuffer)
    .digest('hex');

  console.log(`Computed ${algorithm.toUpperCase()}: ${computedHash}`);

  const matches = computedHash === expectedHash;

  if (matches) {
    console.log('✓ File integrity verified');
  } else {
    console.log('✗ WARNING: File integrity check failed!');
    console.log('  File may be corrupted or tampered with');
  }

  return matches;
}

// Usage: Verify software download
const verified = await verifyFileIntegrity(
  'node-v18.0.0.tar.gz',
  '7a5c1c7c3e3f1c5f7c5c7c5c7c5c7c5c7c5c7c5c7c5c7c5c7c5c7c5c7c5c7c5'
);

// Real-world example: Package managers
// npm: Uses SHA-512 for package integrity
// apt: Uses MD5/SHA256 for .deb packages
// Docker: Uses SHA-256 for image layers

2. Content Deduplication

// Deduplicate files using content hashing
class FileDeduplicator {
  constructor() {
    this.hashIndex = new Map();  // hash -> file path
  }

  async addFile(filePath) {
    // Compute file hash
    const fileBuffer = await fs.readFile(filePath);
    const hash = crypto
      .createHash('sha256')
      .update(fileBuffer)
      .digest('hex');

    // Check if file already exists
    if (this.hashIndex.has(hash)) {
      const existingPath = this.hashIndex.get(hash);
      console.log(`Duplicate found!`);
      console.log(`  Existing: ${existingPath}`);
      console.log(`  Duplicate: ${filePath}`);
      console.log(`  Hash: ${hash}`);
      return { duplicate: true, existingPath };
    }

    // New unique file
    this.hashIndex.set(hash, filePath);
    console.log(`✓ New file: ${filePath}`);
    return { duplicate: false, hash };
  }

  async deduplicateDirectory(dirPath) {
    const files = await glob(`${dirPath}/**/*`, { nodir: true });

    console.log(`\nScanning ${files.length} files...\n`);

    let duplicates = 0;
    let uniqueFiles = 0;
    let spaceSaved = 0;

    for (const file of files) {
      const result = await this.addFile(file);

      if (result.duplicate) {
        duplicates++;
        const stats = await fs.stat(file);
        spaceSaved += stats.size;

        // Optional: Delete duplicate
        // await fs.unlink(file);
      } else {
        uniqueFiles++;
      }
    }

    console.log(`\n=== Deduplication Summary ===`);
    console.log(`Total files: ${files.length}`);
    console.log(`Unique files: ${uniqueFiles}`);
    console.log(`Duplicates: ${duplicates}`);
    console.log(`Space saved: ${(spaceSaved / 1024 / 1024).toFixed(2)}MB`);

    return { uniqueFiles, duplicates, spaceSaved };
  }
}

// Usage: Deduplicate backup directory
const deduplicator = new FileDeduplicator();
await deduplicator.deduplicateDirectory('./backups');

// Real-world applications:
// - Git: Uses SHA-1 for content addressing
// - Dropbox: Deduplicates files across all users
// - Backup systems: Store each unique file once

3. API Request Signing

// Sign API requests to prevent tampering
class APIClient {
  constructor(apiKey, apiSecret) {
    this.apiKey = apiKey;
    this.apiSecret = apiSecret;
  }

  signRequest(method, path, body = null) {
    // Create signature payload
    const timestamp = Date.now();
    const nonce = crypto.randomBytes(16).toString('hex');

    let payload = `${method}${path}${timestamp}${nonce}`;

    if (body) {
      payload += JSON.stringify(body);
    }

    // Generate HMAC signature
    const signature = crypto
      .createHmac('sha256', this.apiSecret)
      .update(payload)
      .digest('hex');

    return {
      headers: {
        'X-API-Key': this.apiKey,
        'X-Timestamp': timestamp,
        'X-Nonce': nonce,
        'X-Signature': signature
      }
    };
  }

  async request(method, path, body = null) {
    const { headers } = this.signRequest(method, path, body);

    const response = await fetch(`https://api.example.com${path}`, {
      method,
      headers: {
        ...headers,
        'Content-Type': 'application/json'
      },
      body: body ? JSON.stringify(body) : undefined
    });

    return response.json();
  }
}

// Server-side verification
function verifyAPISignature(req) {
  const signature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];
  const nonce = req.headers['x-nonce'];
  const apiKey = req.headers['x-api-key'];

  // Verify timestamp (prevent replay attacks)
  const now = Date.now();
  if (Math.abs(now - timestamp) > 60000) {  // 1 minute window
    throw new Error('Request expired');
  }

  // Get API secret from database
  const apiSecret = getAPISecret(apiKey);

  // Reconstruct payload
  let payload = `${req.method}${req.path}${timestamp}${nonce}`;
  if (req.body) {
    payload += JSON.stringify(req.body);
  }

  // Verify signature
  const expectedSignature = crypto
    .createHmac('sha256', apiSecret)
    .update(payload)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
    throw new Error('Invalid signature');
  }

  return true;
}

4. Caching Strategy

// Generate cache keys from request parameters
class CacheManager {
  constructor(redis) {
    this.redis = redis;
  }

  generateCacheKey(prefix, params) {
    // Sort parameters for consistent keys
    const sortedParams = Object.keys(params)
      .sort()
      .reduce((acc, key) => {
        acc[key] = params[key];
        return acc;
      }, {});

    // Hash parameters
    const paramsString = JSON.stringify(sortedParams);
    const hash = crypto
      .createHash('sha256')
      .update(paramsString)
      .digest('hex')
      .substring(0, 16);  // First 16 chars

    return `${prefix}:${hash}`;
  }

  async getCached(key, fetchFunction) {
    // Check cache
    const cached = await this.redis.get(key);

    if (cached) {
      console.log(`✓ Cache hit: ${key}`);
      return JSON.parse(cached);
    }

    // Cache miss - fetch and store
    console.log(`✗ Cache miss: ${key}`);
    const data = await fetchFunction();

    await this.redis.setex(key, 3600, JSON.stringify(data));  // 1 hour TTL

    return data;
  }
}

// Usage
app.get('/api/products', async (req, res) => {
  const cacheKey = cacheManager.generateCacheKey('products', {
    category: req.query.category,
    sort: req.query.sort,
    page: req.query.page
  });

  const products = await cacheManager.getCached(cacheKey, async () => {
    return await db.query('SELECT * FROM products WHERE ...');
  });

  res.json(products);
});

5. Data Integrity in Databases

// Ensure data hasn't been tampered with
class AuditLog {
  async createEntry(userId, action, data) {
    const entry = {
      id: uuidv4(),
      userId,
      action,
      data,
      timestamp: new Date()
    };

    // Calculate hash of entry (without hash field)
    const entryString = JSON.stringify(entry);
    const hash = crypto
      .createHash('sha256')
      .update(entryString)
      .digest('hex');

    entry.hash = hash;

    // Store in database
    await db.query(
      'INSERT INTO audit_log (id, user_id, action, data, timestamp, hash) VALUES ($1, $2, $3, $4, $5, $6)',
      [entry.id, entry.userId, entry.action, entry.data, entry.timestamp, entry.hash]
    );

    console.log(`✓ Audit log entry created: ${entry.id}`);
    return entry;
  }

  async verifyEntry(entryId) {
    const entry = await db.query(
      'SELECT * FROM audit_log WHERE id = $1',
      [entryId]
    );

    if (!entry) {
      return { valid: false, reason: 'Entry not found' };
    }

    // Recalculate hash
    const storedHash = entry.hash;
    delete entry.hash;

    const entryString = JSON.stringify(entry);
    const computedHash = crypto
      .createHash('sha256')
      .update(entryString)
      .digest('hex');

    const valid = storedHash === computedHash;

    if (valid) {
      console.log(`✓ Entry ${entryId} verified`);
    } else {
      console.log(`✗ WARNING: Entry ${entryId} has been tampered with!`);
    }

    return { valid, storedHash, computedHash };
  }
}

Performance Optimization

// Benchmark different hash algorithms
async function benchmarkHashAlgorithms(dataSize = 1024 * 1024) {
  const data = crypto.randomBytes(dataSize);
  const algorithms = ['md5', 'sha1', 'sha256', 'sha512', 'sha3-256'];

  console.log(`\nBenchmarking with ${dataSize / 1024}KB data\n`);

  for (const algo of algorithms) {
    const iterations = 100;
    const start = Date.now();

    for (let i = 0; i < iterations; i++) {
      crypto.createHash(algo).update(data).digest('hex');
    }

    const duration = Date.now() - start;
    const rate = (dataSize * iterations / duration / 1024).toFixed(2);

    console.log(`${algo.toUpperCase().padEnd(10)}: ${duration}ms (${rate}MB/s)`);
  }
}

// Typical results (1MB data, 100 iterations):
// MD5:       150ms (666MB/s)   - Fastest, but insecure
// SHA1:      180ms (555MB/s)   - Fast, deprecated
// SHA256:    250ms (400MB/s)   - Recommended
// SHA512:    180ms (555MB/s)   - Fast on 64-bit systems
// SHA3-256:  800ms (125MB/s)   - Slower, newest standard

Security Best Practices

// DO's and DON'Ts
const securityGuidelines = {
  passwords: {
    NEVER: 'Use MD5, SHA-1, or SHA-256 for passwords',
    ALWAYS: 'Use bcrypt, Argon2, or PBKDF2',
    reason: 'Fast hashes are vulnerable to brute force'
  },

  apiSigning: {
    NEVER: 'Use plain hashes without HMAC',
    ALWAYS: 'Use HMAC with secret key',
    reason: 'HMAC prevents signature forgery'
  },

  comparison: {
    NEVER: 'Use === for hash comparison',
    ALWAYS: 'Use crypto.timingSafeEqual()',
    reason: 'Prevents timing attacks'
  },

  storage: {
    NEVER: 'Store sensitive hashes in logs',
    ALWAYS: 'Keep hashes in secure database',
    reason: 'Hash exposure aids attackers'
  }
};

// Correct password hashing
async function correctPasswordHashing(password) {
  // Use bcrypt with high cost factor
  const hash = await bcrypt.hash(password, 12);
  return hash;
}

// Correct HMAC usage
function correctHMACUsage(data, secret) {
  return crypto
    .createHmac('sha256', secret)
    .update(data)
    .digest('hex');
}

// Correct comparison
function correctComparison(hash1, hash2) {
  return crypto.timingSafeEqual(
    Buffer.from(hash1),
    Buffer.from(hash2)
  );
}

Testing Hash Functions

// Jest tests
const crypto = require('crypto');

describe('Hash Generation', () => {
  test('generates consistent SHA-256 hash', () => {
    const input = 'Hello World';
    const hash1 = crypto.createHash('sha256').update(input).digest('hex');
    const hash2 = crypto.createHash('sha256').update(input).digest('hex');

    expect(hash1).toBe(hash2);
  });

  test('different inputs produce different hashes', () => {
    const hash1 = crypto.createHash('sha256').update('Hello').digest('hex');
    const hash2 = crypto.createHash('sha256').update('World').digest('hex');

    expect(hash1).not.toBe(hash2);
  });

  test('avalanche effect - small change creates different hash', () => {
    const hash1 = crypto.createHash('sha256').update('Hello World').digest('hex');
    const hash2 = crypto.createHash('sha256').update('Hello World!').digest('hex');

    // Hashes should be completely different
    let differentChars = 0;
    for (let i = 0; i < hash1.length; i++) {
      if (hash1[i] !== hash2[i]) differentChars++;
    }

    // At least 50% of characters should be different
    expect(differentChars / hash1.length).toBeGreaterThan(0.5);
  });

  test('HMAC with different secrets produces different signatures', () => {
    const data = 'message';
    const sig1 = crypto.createHmac('sha256', 'secret1').update(data).digest('hex');
    const sig2 = crypto.createHmac('sha256', 'secret2').update(data).digest('hex');

    expect(sig1).not.toBe(sig2);
  });
});

Conclusion: Hashes Are Fundamental to Security

Cryptographic hash functions are the invisible foundation of modern software security. From password storage to blockchain, file verification to API authentication, hashes enable trust in digital systems.

✅ One-way function (cannot reverse)

✅ Deterministic (same input = same hash)

✅ Fast computation (millions of hashes/second)

✅ Avalanche effect (small change = different hash)

✅ Collision resistant (practically impossible duplicates)

✅ Universal support (every language, platform)

✅ Battle-tested (decades of cryptanalysis)

✅ Multiple applications (security, caching, deduplication)

Implementation Checklist:

[ ] Use SHA-256 for general hashing (files, data)
[ ] Use bcrypt/Argon2 for passwords (NEVER fast hashes)
[ ] Use HMAC for API signing and authentication
[ ] Use timing-safe comparison for hash verification
[ ] Verify file integrity with checksums
[ ] Implement content-based deduplication
[ ] Cache with hash-based keys
[ ] Never log sensitive hashes

The Bottom Line:
Hashing isn't just about security—it's about data integrity, efficient caching, and scalable architecture. Whether you're storing passwords, verifying files, or signing API requests, choosing the right hash algorithm and using it correctly is critical.

SHA-256 is the gold standard for 2024. Use it for everything except passwords (use bcrypt/Argon2).

What's your hash strategy? Share your use cases in the comments!

DEV Community