Cryptographic Hash Functions: MD5, SHA-256, and Beyond

Generating Hashes in JavaScript

// SHA-256 in the browser using Web Crypto API
async function sha256(message) {
  const encoder = new TextEncoder();
  const data = encoder.encode(message);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

// Usage
const hash = await sha256('Hello, World!');
console.log(hash);
// "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f"

// Verifying file integrity
async function verifyFileHash(file, expectedHash) {
  const buffer = await file.arrayBuffer();
  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  const actualHash = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return actualHash === expectedHash;
}

Password Hashing with Bcrypt (Node.js)

import bcrypt from 'bcrypt';

// Hashing a password (during registration)
async function hashPassword(plainPassword) {
  const saltRounds = 12; // Higher = slower = more secure
  const hash = await bcrypt.hash(plainPassword, saltRounds);
  return hash; // "$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4c.4/4c.4/4c.4/4"
}

// Verifying a password (during login)
async function verifyPassword(plainPassword, storedHash) {
  const isMatch = await bcrypt.compare(plainPassword, storedHash);
  return isMatch; // true or false
}

// ❌ WRONG: Don't do this!
const badHash = await sha256(password); // Fast hash = easily cracked

// ✅ CORRECT: Use slow password hashes
const goodHash = await bcrypt.hash(password, 12);