\    "hello"    file.iso    4 tb backup     /
 \                                         /
  \              any size in              /
   \                                     /
    '-----------.           .-----------'
                \           /
                 | sha-256 |
                 | ####### |
                  \       /
                   '-. .-'
                     | |
                      v
               2cf24dba5fb0...
             always 256 bits out

A hash function turns any input into a short, fixed-size fingerprint. The same input gives the same fingerprint every time. Change a single bit and the fingerprint changes completely.

what it looks like

$ echo -n hello | sha256sum
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

$ echo -n hellp | sha256sum
fdd7585e08c4e2afd71dcabdb4636c89d557a3f42db9e2040c8bbd1708aa4ce7

One letter changed and 131 of the 256 output bits flipped. That is the avalanche effect: similar inputs give unrelated outputs.

the three properties

preimage resistance
  given a hash h, you can't find any m where hash(m) = h

second preimage resistance
  given m1, you can't find a different m2 with the same hash

collision resistance
  you can't find any two inputs with the same hash

A hash is one way. There is no key and no way to turn a hash back into its input. The only attack is guessing, and the output space is too big to search.

where they are used

• integrity: check a download matches its published checksum
• signatures: you sign the hash of a document, not the document itself
• hmac: a hash mixed with a secret key, proves a message was not altered
• git: every commit, tree and file is named by its hash
• passwords: stored as a slow, salted hash, never as plain text

passwords need slow hashes

SHA-256 is built to be fast, which is exactly wrong for passwords: a GPU can try billions of guesses a second. Use a password hashing function such as Argon2id, scrypt or bcrypt. They are deliberately slow and memory hungry, and a random salt means two identical passwords get different hashes.

which to use

md5         broken    collisions in seconds on a laptop
sha-1       broken    real-world collision shown in 2017
sha-256     good      the default almost everywhere
sha-3       good      different design, a solid backup
blake2/3    good      very fast, common in modern tools

Hashes hold up well against quantum computers. Grover's algorithm only gives a square-root speedup, and SHA-256 and SHA-3 are still considered safe.