Take a novel.
Take a photograph.
Take a 40-gigabyte backup.
Feed each into a cryptographic hash function and you can obtain a compact digest.
The digest is not a miniature copy of the source.
It is a fingerprint.
Quick Read
NIST defines a cryptographic hash function as a function that maps a bit string of arbitrary length to a fixed-length bit string. Modern approved hash functions are designed around three core security properties: collision resistance, preimage resistance and second-preimage resistance.
That is an extraordinary compression of representation. A huge source becomes a short digest. Yet this is not compression in the ordinary sense because the digest is not designed to reconstruct the source. It is designed to support comparison, integrity, authentication-related constructions and other tasks where the source itself can remain elsewhere.
One-sentence answer: hashing is lossy because arbitrarily rich input is collapsed into a much smaller fingerprint that preserves evidence about identity or integrity while discarding the information needed to reconstruct the original message.
The First Surprise: Fixed Length From Arbitrary Length
A hash function can accept a tiny message or a huge one and still return a digest of the same prescribed length for that algorithm.
This immediately tells us something mathematical.
There are vastly more possible input messages than output digests.
Therefore collisions must exist in principle: distinct inputs that map to the same output.
Cryptographic collision resistance does not claim collisions are impossible. It claims that finding useful collisions should be computationally infeasible for the intended security strength.
Hashing Is Not Encryption
Encryption is designed so authorised parties can recover plaintext using a key.
Hashing is not designed to be reversed.
That distinction matters because people often describe both as “scrambling”.
A ciphertext is a protected representation intended to preserve recoverability under the right key. A cryptographic digest is a one-way representation intended to support verification-like tasks without carrying recoverable source content.
Preimage Resistance: Given the Fingerprint, Do Not Hand Me the Original
Suppose I give you a digest.
Preimage resistance means it should be computationally infeasible to find an input that produces that chosen digest.
This is what gives the hash its one-way flavour.
But the property depends on the input space too. If the possible input is one of only four PINs, an attacker can simply hash all four candidates. Strong hash functions do not make tiny guessable secrets magically strong.
Second-Preimage Resistance: Given This Message, Find Me Another With the Same Digest
Second-preimage resistance starts from a specific existing input.
The challenge is to find a different input with the same digest.
This property matters when a digest is being used to bind or verify a particular message.
Collision Resistance: Find Any Two Different Inputs That Match
Collision resistance asks for something different.
Can an attacker find any two different inputs with the same digest?
Because the output space is finite, collisions exist. Security comes from making deliberate discovery computationally infeasible at practical scales.
This is one reason cryptographic hash algorithms age. A function considered strong decades ago can become unsuitable after new cryptanalysis or increasing computational capability. NIST has long deprecated SHA-1 for security-sensitive purposes and recommends modern approved algorithms instead.
The Avalanche Effect: Tiny Input Change, Wildly Different Digest
Change one character in a document and a well-designed cryptographic hash should produce a digest that looks unrelated to the old one.
This helps integrity checking because tiny source modifications do not create tiny digest modifications that preserve obvious structure.
The digest is not a semantic summary.
Two nearly identical essays should not produce nearly identical cryptographic hashes merely because their meanings are similar.
Hashing Preserves Sameness Better Than Similarity
Cryptographic hashes are excellent for exact identity checks.
If two files have the same strong digest, we gain powerful evidence they are the same bit sequence, subject to the algorithm’s security assumptions.
But change one pixel and the digest changes radically.
This makes ordinary cryptographic hashing bad at perceptual similarity.
Other families such as perceptual hashes deliberately preserve a different property: near-similar media should have near-similar fingerprints. Different fingerprint, different job.
Integrity Checking: The Great Everyday Use
Download a large software image.
The publisher provides a trusted SHA-256 digest.
You hash your downloaded file and compare.
If the digests differ, something changed.
The digest does not tell you where the error is or what the correct byte should be. It tells you the received object is not the object whose digest you expected.
A Hash Is a Tiny Witness, Not the Evidence Itself
This distinction is vital in archives and research.
A checksum can demonstrate that a stored file still matches an earlier checked state.
It cannot prove the original scan was focused, the metadata was correct, or the source had not already been manipulated before hashing.
Fixity protects continuity of bits.
It does not certify truthfulness of origin.
Hash Tables Use Hashing for a Different Goal
Not every hash function is cryptographic.
Computer systems use non-cryptographic hashes for fast indexing and lookup. Here the goal may be speed and even distribution rather than resistance to adversarial collisions.
Two concepts share a family resemblance—map richer inputs into compact codes—but the engineering requirements differ.
Password Hashing Is More Complicated Than “Just Hash the Password”
Passwords come from low-entropy human choices.
Fast general-purpose hashes let attackers test guesses rapidly.
Secure password storage therefore uses password-hashing or key-derivation schemes designed to be deliberately expensive, usually with unique salts and configurable work factors.
The core Lossy lesson is that the same compact fingerprint can be safe or unsafe depending on the surrounding protocol.
Merkle Trees: Hashes Can Build Large Structures
Hash individual blocks.
Combine their hashes and hash again.
Repeat until one root digest represents the integrity structure of a large collection.
This is the idea behind Merkle trees.
A compact root can commit to a vast set of underlying data while efficient proofs can demonstrate inclusion or consistency without transmitting the entire dataset.
This is compression of verification, not compression of content.
Deduplication Begins With the Same Question: Have I Seen This Before?
Storage systems can hash files or blocks and compare digests to identify exact duplicates efficiently.
If the same content appears many times, the system may store one underlying copy and maintain references.
The hash becomes an index into sameness.
But deduplication then introduces a new problem: when are two things truly “the same” for the system’s purpose? That belongs to the next article.
Education: A Mark Scheme Can Act Like a Human Hash—But Only Metaphorically
A teacher may see a full written answer and reduce it to a small mark code: 0, 1, 2, 3.
Many rich responses collapse to the same score.
This is not cryptographic hashing, but the structural analogy is useful. A tiny output can preserve one decision-relevant property while losing nearly everything else.
The danger begins when the score is later treated as though it were the original reasoning.
When Hashing Is Exactly the Right Loss
If the receiver only needs to know whether a file changed, carrying the whole file into every comparison is wasteful.
A digest is almost perfectly task-shaped.
It destroys recoverability and preserves comparison power.
That is a beautiful example of lossy representation improving a system because the discarded information is not needed for the current job.
When Hashing Becomes Dangerous
- A deprecated hash is used where collision resistance matters.
- A password is protected with a fast unsalted general-purpose hash.
- A checksum is treated as proof that source content is truthful rather than merely unchanged.
- A cryptographic hash is used to detect perceptual similarity.
- A digest replaces the preservation copy instead of merely identifying it.
- An application ignores how truncating digest length reduces collision security.
A Practical Hashing Audit
- Job: integrity, indexing, authentication construction, password storage or another purpose?
- Algorithm: is the hash appropriate and current for that purpose?
- Threat: are attackers trying to find preimages, second preimages or collisions?
- Input space: is the source itself easy to guess?
- Digest length: has the output been truncated?
- Source retention: does the system still preserve the actual evidence somewhere?
- Interpretation: is sameness being confused with semantic similarity?
Sources and Further Reading
- NIST CSRC: Cryptographic hash function.
- NIST Hash Functions project, including approved SHA-2 and SHA-3 families and security properties.
- NIST FIPS 180 and FIPS 202 for approved hash standards.
Continue Through eduKateSG
Continue with How Lossy Works | Generation Loss, How Lossy Works | Preservation Masters and Access Copies, and the companion article How Lossy Works | Deduplication.
Final Thought: The Fingerprint Is Powerful Because It Is Not the Finger
A hash digest is radically smaller than the thing it represents.
It can verify continuity without preserving content.
That is not failed compression.
It is a representation engineered to remember only the question the system needs to ask.