#️⃣ Hashing & the Avalanche Effect
A hash function takes any input and produces a fixed-length, seemingly random output. Type below and watch the live SHA-256 hash of your text — then change just one character and see how much the output changes.
Hashing runs locally using your browser’s built-in Web Crypto API. Nothing you type
is sent anywhere.
SHA-256 hash
—
Characters different from previous hash: 0 / 64
Input length changed by: 0 character(s)
What to notice
- Fixed length: whether you type one letter or a full paragraph, SHA-256 always outputs 64 hex characters (256 bits).
- Avalanche effect: changing a single character completely scrambles the output — roughly half the hex characters change, even though the input barely changed.
- One-way: there’s no way to reverse a hash back into the original text. The only practical way to “undo” it is to guess inputs and hash them until one matches — which is exactly what password cracking does.
- Deterministic: the same input always produces the same hash, which is why sites can check a password by hashing what you type and comparing it to the stored hash, without ever storing your real password.
Why this matters for passwords
- Sites should never store your plaintext password — only a hash of it (plus a random “salt” to stop attackers from precomputing hashes for common passwords).
- Fast hashes like plain SHA-256 or MD5 are actually a bad choice for password storage, because attackers can compute billions of them per second on a GPU. Purpose-built slow hashes (bcrypt, scrypt, Argon2) are designed to make that much harder.