# What a hash is, and why changing one letter changes everything

> Feed a hash function “hello” or the whole of Wikipedia and you get back a short fixed-size fingerprint. Change a single letter and the fingerprint looks completely different. That odd behaviour is what makes hashes useful.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/what-a-hash-is-and-why-changing-one-letter-changes-everything
Related free tool: [Hash Generator](https://toolcloak.pages.dev/tools/hash-generator)

Hash the word `hello` with SHA-256 and you get `2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824`. Change the last letter to make `hellp` and you get `fdd7585e08c4e2af…`. Not similar. Not nearby. Completely different. That is not a bug. It is the point.

> **In short**
> - A hash is a fixed-size fingerprint: same input, same output, and no way back.
> - Change one letter and about half of the 256 bits flip. That is the avalanche effect.
> - Use SHA-256 for files and data. Never use plain SHA-256 to store passwords.

A hash function takes any amount of data and boils it down to a fixed-length fingerprint. Same input always gives the same fingerprint. A different input, even by one character, gives a wildly different one. Once you accept those two rules, a lot of everyday technology makes sense: file checks, version control, password storage and more.

## Three promises a good hash makes

1. **Same input, same output.** Hash the same text a million times and you get the same fingerprint a million times, on any computer.
2. **Fixed size.** A single letter or a ten-gigabyte video both give you, for SHA-256, exactly 64 hexadecimal characters.
3. **One way.** You can go from the text to the fingerprint easily. Going back from the fingerprint to the text is, for practical purposes, impossible.

**SHA-256 in numbers**

|  | Value | Note |
| --- | --- | --- |
| Size of the fingerprint | 256 bits | That is 32 bytes |
| Hex characters shown | 64 | Four bits per character |
| Possible fingerprints | 2²⁵⁶ | Roughly 10⁷⁷, a 78-digit number |

*Whatever you feed in, the answer has exactly this shape.*

Try it: [Hash Generator](https://toolcloak.pages.dev/tools/hash-generator). Type or paste text and see its SHA-1, SHA-256 and SHA-512 fingerprints, calculated locally in your browser.

## One letter, a completely different fingerprint

Look at three tiny inputs that differ by one character, hashed with SHA-256. Only the beginning of each fingerprint is shown, but you will see that they have nothing in common.

| Input | SHA-256 (first 16 characters) |
| --- | --- |
| `hello` | `2cf24dba5fb0a30e` |
| `hellp` | `fdd7585e08c4e2af` |
| `Hello` | `185f8db32271fe25` |

*Changing e→p, or h→H, produces fingerprints with no resemblance at all. There is no “close” in the output, even when the input is very close.*

This is called the **avalanche effect**. If you compare the full 256 bits of `hello` against `hellp`, **131 of them differ**. Comparing `hello` and `Hello`, 125 differ. That is about half, which is exactly what you would expect from two unrelated random strings.

**How many of the 256 bits change when ‘hello’ becomes ‘hellp’**

|  | Share |
| --- | --- |
| Bits that changed | 131 |
| Bits that stayed | 125 |

*About half the bits flip, no matter how small the change. That is what stops anyone reading a pattern in the output.*

## What hashes are used for

- **Checking a download.** A site publishes the SHA-256 of a file. You hash your copy. If the fingerprints match, the file was not corrupted or tampered with on the way.
- **Finding duplicates.** Two files with the same hash are, for all practical purposes, identical, so you can find copies without comparing them byte by byte.
- **Version control.** Git identifies every commit by a hash of its contents, so history cannot be quietly rewritten without every later fingerprint changing.
- **Digital signatures and certificates.** Signing a long document is slow, so you hash it and sign the short fingerprint instead.
- **Storing passwords.** A site should keep a hash of your password, not the password. But read the warning below, because the type of hash matters a lot.

## Hashing is not encryption

Encryption is meant to be reversed with a key. A hash is meant to **not** be reversed at all, and there is no key. You cannot “decrypt” a SHA-256 fingerprint. What people do instead is **guess**: hash many candidate inputs and see which one matches.

> **Plain SHA-256 is the wrong tool for passwords:** SHA-256 is designed to be fast, and fast is exactly what an attacker wants when guessing billions of passwords. Passwords should be stored with a deliberately slow, salted method such as bcrypt, scrypt or Argon2. Use a general hash for files and data, not for passwords.

## Which algorithm, and which are retired

**Length of the output in hex characters**

|  | Characters |
| --- | --- |
| MD5 (128 bits) | 32 |
| SHA-1 (160 bits) | 40 |
| SHA-256 (256 bits) | 64 |
| SHA-512 (512 bits) | 128 |

*Longer output means more room for the fingerprint to be unique, but length is not the only thing that decides safety.*

- **MD5** and **SHA-1** have known collision attacks: researchers have built two different inputs that give the same fingerprint. Do not use them where an attacker is involved, such as signatures. They are still fine for catching accidental corruption.
- **SHA-256** and **SHA-512** are the sensible defaults today for integrity checks and signatures.
- **Larger is not always better.** SHA-512 is not “safer” than SHA-256 for most uses. It is just longer, and sometimes faster on 64-bit machines.

## A small trap: invisible differences

If you hash text and your friend hashes the “same” text but gets a different answer, look for invisible differences: a trailing space, a newline at the end, a different capital letter, or text saved in a different encoding. A hash sees every byte. Anything a human would ignore, the function counts.

## Frequently asked questions

### What is a hash?

A fixed-length fingerprint of some data produced by a hash function. The same input always gives the same output, and a tiny change to the input gives a completely different output.

### Is hashing the same as encryption?

No. Encryption can be reversed with a key. A hash is one-way and has no key, so you cannot decrypt it. You can only guess inputs and compare their hashes.

### Can a SHA-256 hash be reversed?

Not by calculation. People recover short or common inputs by guessing and hashing many candidates, which is why weak passwords are still at risk even when hashed.

### Should I use SHA-256 to store passwords?

No. It is too fast, which helps attackers. Use a slow, salted password hash such as bcrypt, scrypt or Argon2 instead.

### Why do MD5 and SHA-1 count as broken?

Because researchers have shown practical ways to create two different inputs with the same hash. That is unsafe for signatures and security checks, though fine for catching accidental file corruption.