A hash is a short, fixed-length "fingerprint" of a piece of data. A hash function takes an input of any size, such as one word, a file or a block of transactions, and always returns an output of the same length. SHA-256, for example, always returns 256 bits. The same input always produces the same hash. Any change to the input, even a single character, produces a completely different hash. In NIST's words, digests "are used to detect whether messages have been changed since the digests were generated." Blockchains use hashes to link blocks, to identify transactions, to build addresses and to run proof-of-work mining.
How a hash function behaves
Here is SHA-256 run on two inputs that differ only in their first letter's case:
hello→2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Hello→185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
The two outputs have nothing visibly in common. You can't tell from them that the inputs were nearly identical, and you can't work backwards from either one to the original word.
The three security properties
A cryptographic hash function is an ordinary hash function plus security guarantees. NIST defines three:
- Collision resistance. "It is computationally infeasible to find two different inputs to the hash function that have the same hash value."
- Preimage resistance. "Given a randomly chosen hash value, it is computationally infeasible to find an input message that hashes to this hash value." This is the property people mean when they call hashing "one-way."
- Second preimage resistance. "It is computationally infeasible to find a second input that has the same hash value as any other specified input."
"Computationally infeasible" does not mean impossible. It means no known method can do it with realistic computing resources. That bar can fall over time, as SHA-1 shows below.
Hashing is not encryption
Encryption can be reversed by anyone who holds the key. A hash has no key and cannot be reversed. A hash shows that data has not changed. It does not hide data so that it can be recovered later.
Which hash functions are standard
NIST approves two families:
- SHA-2 (FIPS 180-4, August 2015): SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256. The same standard also specifies the older SHA-1.
- SHA-3 (FIPS 202, published 4 August 2015): SHA3-224, SHA3-256, SHA3-384 and SHA3-512. Each is based on Keccak, the algorithm NIST picked as the winner of its SHA-3 competition. FIPS 202 also defines two extendable-output functions, SHAKE128 and SHAKE256. NIST says only the four fixed-length SHA-3 algorithms are approved hash algorithms. On 13 March 2025 NIST said it had decided to update FIPS 202.
SHA-1 shows how a hash function is retired
- 2011: NIST deprecated SHA-1.
- End of 2013: NIST disallowed SHA-1 for digital signatures.
- 23 February 2017: researchers at CWI Amsterdam and Google published the first real SHA-1 collision, under the name SHAttered. It took about nine quintillion SHA-1 computations, which the researchers estimated at roughly 6,500 CPU-years plus 110 GPU-years.
- 15 December 2022: NIST announced that SHA-1 "has reached the end of its useful life" and should be phased out by 31 December 2030.
The lesson: when a hash function's collision resistance breaks in practice, systems that depend on it have to move to a stronger one.
How Bitcoin uses hashing
Bitcoin's developer documentation describes several separate uses of hashing.
Transaction IDs
Each raw transaction is hashed twice with SHA-256, written SHA256(SHA256()), to produce its transaction ID (TXID).
The Merkle root
All TXIDs in a block are paired, joined and hashed again with double SHA-256, row by row, until one hash remains: the Merkle root. If a row has an odd number of hashes, the last one is paired with a copy of itself. The generation transaction's TXID comes first. If a block contains only the generation transaction, its TXID is the Merkle root.
The block header and the chain
Each block header is 80 bytes and has six fields:
| Field | Size |
|---|---|
| version | 4 bytes |
| previous block header hash | 32 bytes |
| Merkle root | 32 bytes |
| time | 4 bytes |
| nBits (encoded target) | 4 bytes |
| nonce | 4 bytes |
The header stores the previous block's header hash, so the blocks form a chain. Changing one transaction changes its TXID. That changes the Merkle root, which changes the header hash. Every later block would then have to be rebuilt too. This is how hashing makes tampering easy to spot.
Proof-of-work and hash rate
To mine a block, a miner hashes the 80-byte header and needs a result that "does not exceed a certain value," called the target threshold. The nBits field stores this target in compact form. Miners keep changing fields such as the nonce and hashing again until they find a valid result. Every 2,016 blocks, the network compares how long those blocks took with the ideal of two weeks (1,209,600 seconds) and adjusts the target. The developer documentation notes that an off-by-one error in Bitcoin Core means it actually uses timestamps from 2,015 blocks.
"Hash rate" is how many of these hash attempts miners make per second, across the whole network.
Addresses
A standard P2PKH address is built from RIPEMD-160(SHA256(public key)). A version byte is added in front, then a four-byte checksum, and the result is Base58Check-encoded. P2SH addresses apply the same double hash to a script.
How SHA-1 was retired, step by step
Follow the dates on which SHA-1 went from a standard hash function to one that has to be phased out.
- 2011NIST deprecates SHA-1confirmed
NIST deprecated SHA-1, which the SHA-2 standard (FIPS 180-4) still specifies alongside SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256.
- End of 2013Disallowed for digital signaturesconfirmed
NIST disallowed SHA-1 for digital signatures.
- 23 February 2017First real SHA-1 collision: SHAtteredconfirmed
Researchers at CWI Amsterdam and Google published the first real SHA-1 collision. It took about nine quintillion SHA-1 computations, estimated at roughly 6,500 CPU-years plus 110 GPU-years. That broke collision resistance in practice, not just on paper.
- 15 December 2022NIST says SHA-1 has reached the end of its useful lifeconfirmed
NIST announced that SHA-1 "has reached the end of its useful life" and set a date for phasing it out.
- 31 December 2030Phase-out deadlineexpected
The date by which NIST says SHA-1 should be phased out. Systems that depend on it have to move to a stronger hash function, such as one from the SHA-2 or SHA-3 families.
This shows only NIST's SHA-1 milestones and the SHAttered collision named in the article. It does not show which systems still use SHA-1 or how secure SHA-2 and SHA-3 will stay as new attacks are published.
How Ethereum uses hashing
An Ethereum account address is "the last 20 bytes of the Keccak-256 hash of the public key," with 0x added in front. The result is 42 characters long.
Hashing outside blockchains
- File and message integrity. A downloaded file's hash can be compared with the hash its publisher lists. If they match, the file has not been altered.
- Password storage. NIST SP 800-63B says passwords "SHALL be salted and hashed using a suitable password hashing scheme." The salt must be at least 32 bits, and the cost factor "SHOULD be as high as practical." A plain fast hash such as a single SHA-256 is not a password hashing scheme in this sense.
- Hash tables. In ordinary programming, non-cryptographic hash functions map keys to storage slots for fast lookups. These do not need the security properties above.
Limitations
This guide covers the main hash functions and how Bitcoin and Ethereum use them. It does not cover how the algorithms work internally, and how secure a function is can change as new attacks are published.
