Hash

You download an installer. Its publisher has provided a checksum, and you calculate the fingerprint of your copy using the same algorithm. If they differ, the data is not the same: the file may have been damaged, substituted or modified. A match with a trustworthy fingerprint, on the other hand, gives strong assurance that you have the correct copy. You do not need to compare the entire file manually. SHA-256, for example, produces a 256-bit result, usually written as 64 hexadecimal characters, whether the input is a short message or a large file. [1] [3]

The catch is where the reference fingerprint comes from. If an attacker replaces both a file and its published hash on a website, the two will match. Hashing requires no secret key; anyone can hash public data. That makes it different from a digital signature, through which a key holder attests to data. Bitcoin Core download verification checks not only the file’s hash but also signatures on the checksum list and the trustworthiness of the signing keys. A hash alone proves neither authorship, software safety nor the truth of a document. [3]

Hashing has no reverse “decrypt” step. A fixed-length result does not carry the entire file, so it is not a backup method. But that does not mean a hash safely hides anything you give it. If someone hashes a short, common password, an attacker can try likely passwords and compare their hashes. There is no need to reverse the function: guessing the input is enough. A fast hash alone therefore replaces neither a strong password nor a method designed for secure password storage. [1] [5]

In a preimage search, you are given a hash and try to find data that produces it. In a collision search, any two different inputs with the same hash will do. Collisions mathematically exist because there are more possible inputs than fixed-length outputs. A cryptographic function’s security lies in making such cases impractical to find, not in making them impossible. Also, “hash” does not name a single algorithm: not every hash function is intended for cryptographic security. [1]

Bitcoin uses hashes to identify transactions, link blocks and verify mining work. But the exact recipe varies. A block header’s hash applies SHA-256 twice; HASH160 combines SHA-256 with RIPEMD-160. A tagged hash additionally separates calculation purposes using a tag. To verify a result yourself, you need both the right algorithm and the precise input bytes—the basic units of data. The text “61” consists of different bytes from the single byte with hexadecimal value 61, which represents the letter a in ASCII. Hashing a displayed representation rather than the data is therefore a different calculation. [2] [4]