Hashing: SHA-256 and bcrypt
Two jobs land on Tiffin's desk in the same week. The pipeline downloads a scanner tool and must be sure the file was not swapped. And the login system must store customer passwords so that a leaked database does not leak the passwords. Both jobs use hashing, but the right hash is different for each.
The rule
A hash is a one-way fingerprint: fast for files, slow and salted for passwords.
A cryptographic hash function turns any input into a fixed-size value, the digest. Good hashes have three properties:
- Deterministic: the same input always gives the same digest.
- One-way: you cannot work backwards from the digest to the input.
- Collision-resistant: finding two inputs with the same digest is infeasible. Change one bit of input and the digest changes completely.
Hashing is not encryption. There is no key and no "decrypt".
For files, use a fast hash like SHA-256. Pin the expected digest in your repository and compare:
# the expected digest is pinned in the repo, reviewed like any other code
echo "$SCANNER_SHA256 scanner.tar.gz" | sha256sum --checkFor passwords, use a slow, salted password hash such as Argon2, bcrypt or scrypt. People pick guessable passwords. If the user table leaks, a fast hash lets an attacker try billions of guesses per second; a slow hash, tuned to take a noticeable fraction of a second, cuts that to a trickle. A salt is a random value stored with each hash, so two customers with the same password get different hashes and precomputed tables of common passwords stop working.
import bcrypt
stored = bcrypt.hashpw(b"lunch-lover-42", bcrypt.gensalt()) # salt is inside `stored`
bcrypt.checkpw(b"lunch-lover-42", stored) # TrueThe shortcut
Ask one question: "Am I checking a thing, or storing a secret someone typed?" A thing → SHA-256. A typed secret → Argon2 or bcrypt with a salt.
The downloaded scanner
Checking a thing. Pin its SHA-256 digest in the repo and fail the build if
sha256sum --checkfails.
Drills
Answer fast — trust the rule.
What is the key difference between hashing and encryption?
Which is the best choice for storing Tiffin customers' passwords?
What does a salt achieve?
The pipeline downloads scanner.tar.gz. Where should the expected SHA-256 digest come from?
Remember
- A hash is a one-way fingerprint: fast for files, slow and salted for passwords.
- Checking a thing → SHA-256; storing a typed secret → Argon2 or bcrypt.
- Hashing is not encryption, and a checksum is only as trustworthy as where it came from.