Typorithm · medium

Hashing & HMAC

hashing-hmacsecurityhashinghmacsha256

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Hashing & HMAC

Cryptography

A cryptographic hash like SHA-256 is a one-way, collision-resistant fingerprint of data. HMAC mixes in a secret key so a tag proves integrity AND authenticity. Passwords need a slow, salted hash like bcrypt — never raw SHA-256.

A cryptographic hash maps any input to a fixed-size digest. SHA-256 is one-way (you cannot recover the input) and collision-resistant (you cannot find two inputs with the same digest), which makes it ideal for checking that data has not changed.

A plain hash proves integrity but not who produced it — anyone can recompute it. HMAC mixes a shared secret key into the hash, so a matching tag proves both that the data is intact and that it came from someone holding the key (authenticity).

Passwords are different: SHA-256 is far too fast, letting attackers try billions of guesses per second. Use a deliberately slow, salted algorithm such as bcrypt (here via htpasswd -B with cost 12) so each guess is expensive and identical passwords get different hashes.

SHA-256 is one-way and collision-resistant.

HMAC adds a secret key for integrity + authenticity.

Passwords need slow salted hashes (bcrypt), not raw SHA-256.

echo -n "data" | sha256sum
openssl dgst -sha256 file.txt
openssl dgst -sha256 -hmac "key" file.txt
htpasswd -bnBC 12 "" "pass"

Read the implementation

Connect each part of the code to the concept before you type.

1. Hash a string

sha256sum reads stdin and prints a 256-bit one-way digest; -n drops the trailing newline so you hash exactly "data".

echo -n "data" | sha256sum

2. Hash a file

openssl dgst -sha256 computes the SHA-256 digest of a file — used to verify a download was not corrupted.

openssl dgst -sha256 file.txt

3. HMAC with a key

Adding -hmac "key" mixes a secret into the hash, so only holders of the key can produce or check the tag.

openssl dgst -sha256 -hmac "key" file.txt

4. Bcrypt a password

-B selects bcrypt and -C 12 sets the cost, producing a deliberately slow, salted password hash.

htpasswd -bnBC 12 "" "pass"

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.