Turning it into something you cannot reverse, the hash
Put fruit in a blender and you get juice. Looking only at the juice, you cannot exactly recover which fruit went in. A security hash is like this. Feed in some value and a short fingerprint comes out, but from that fingerprint you cannot recover the original value. So instead of storing a password as is, we store only this fingerprint you cannot reverse.
It goes one way only
Imagine a tool where you feed in some value
and out comes a short fingerprint of fixed length.
This tool is called a security hash.
Feed the same value and the same fingerprint always comes out.
But one property is special.
From input the fingerprint is easy to make,
but from the fingerprint you cannot go back to the original input.
A blender can turn fruit into juice
yet cannot turn juice back into the original fruit.
That is why we call it one way.
Use the right arrow to turn input into a fingerprint. Try going back to the left and the path is blocked.
The forward path opened easily
but the backward path was blocked.
This block is the heart of the security,
because with the fingerprint alone you cannot directly know the original value.
So where do we use this property?
The most common place is the password.
If a password is stored as is,
anyone who looks into the store learns it right away.
So we do the following instead.
Store the fingerprint instead of the password
Storing a password letter for letter is risky,
because if the store leaks or someone looks in,
that password is revealed at once.
So we do not store the password itself.
Instead we put the password through the hash
and store only the fingerprint that comes out.
Since the fingerprint is one way,
it alone does not directly reveal the original password.
Even looking at the store,
there are only fingerprints you cannot reverse, lined up.
Tap to compare the two ways. Plain storage shows the password as is, fingerprint storage leaves only a fingerprint you cannot reverse.
The plain-stored side showed the password in the open.
The fingerprint-stored side left only an unreadable fingerprint.
So for storage the fingerprint side is far safer.
But one question arises.
If we do not store the password,
then when a user logs in,
how do we check the password is correct?
There is no original to compare against.
Here another property of the fingerprint shines.
Verify by turning the input into a fingerprint
We said the same value always yields the same fingerprint.
We use this property to verify.
When a user enters a password at login,
we put that input through the hash again
and make a new fingerprint.
Then we compare this new fingerprint
with the stored fingerprint.
If the two match, the same password was entered. You pass.
If the two differ, it is a different password. It is blocked.
Without pulling out the original password,
we verify by comparing fingerprints alone.
Pick an input and tap verify. If the input's fingerprint matches the stored one you pass, otherwise it is blocked.
Only when the right password was entered did the fingerprints match and pass.
A different value became a different fingerprint and was blocked.
This way, without storing the original,
we can tell right from wrong.
Store the fingerprint only, verify by comparing fingerprints.
A single property, being one way,
makes both storage and verification safe.
But we have heard the word hash
in another unit as well.
Is that hash the same as this hash?
Its purpose differs from the data hash
We saw a hash in the data unit too.
There it turned a value into a slot number
to find the data you want quickly.
The purpose was to fix a place fast.
The security hash may look similar in shape,
but its purpose is the opposite.
Here the point is not to find fast
but to make it impossible to reverse.
So a security hash is built
so that going from fingerprint back to the original value is hard.
Same name, different use.
Tap each side to contrast the purposes. The data hash is for finding fast, the security hash is for being irreversible.
Even with the same word hash, data uses it to find fast, security uses it to be irreversible. The purpose sets the property of the tool.
So even a tool of the same name
has a different property matter depending on where it is used.
In security, being irreversible
is the most precious property.
Now let's review it from start to finish.
Let's wrap up
Gathered on one line, it is this.
A security hash turns input into a one-way fingerprint.
From fingerprint back to input cannot be done.
So instead of the password itself,
we store only its fingerprint.
At login we turn the input into a fingerprint again
and check whether it matches the stored fingerprint.
Match and you pass, differ and it is blocked.
Unlike the data hash made for finding fast,
this is a hash made to be irreversible.
One-way fingerprint, store the fingerprint only, verify by comparison. That is how a hash protects.
Tap the key points in order to review. (one-way fingerprint -> store only the fingerprint -> verify by the input's fingerprint -> purpose differs from the data hash)
Now you know how to protect a password
without leaving it as is.
A single fingerprint you cannot reverse
makes both storage and verification safe together.
Neither people nor systems hold the original,
so there is less secret to lose.
Next, how do we move information protected this way
safely along the paths where it is exchanged?
Let's keep exploring together.