> ## Content Index > Fetch the complete content index at: https://www.cryptowithblock.com/llms.txt > Use this file to discover other available public pages before exploring further. # Hashing: The Digital Fingerprint - URL: https://www.cryptowithblock.com/hashing-the-digital-fingerprint/ - Published: 2026-10-30T18:21:32.000Z - Updated: 2026-11-03T15:03:24.000Z - Description: Learn how a hash works as a digital fingerprint, why one changed letter changes everything, and how to use hashes to check a wallet download before you install it. - Author: Crypto With Block - Tags: How Blockchain Works, #lesson ## Hashing: the digital fingerprint Hi, I'm Block. Feed one sentence into a hash function and you get back a code sixty-four characters long. Change a single letter, and the whole code changes. That one trick holds every blockchain together. In this lesson: what a hash is, the four rules it follows, how it chains blocks, and how you can use one to stay safe. In the last lesson, every block carried a fingerprint of the block before it. That fingerprint is called a hash. A hash function takes any input, a word, a file, a whole block of payments, and turns it into a short code of a fixed length. Same input, same hash, every single time. > Same input, same hash, every time. Think about your own fingerprint. It's tiny compared to you, it's unique to you, and anyone can check it against a record. But nobody can rebuild you from it. A hash works the same way. It identifies data without containing it. > Identifies the data. Doesn't contain it. The hash function Bitcoin is built on is called SHA-256, a standard published by NIST, the US government's standards agency. Whatever you feed it, one letter or a whole movie, the result is always two hundred fifty-six bits, usually written as sixty-four letters and numbers. Tiny input or huge input, the fingerprint is always the same size. > Any input. Always the same size. ## The four rules Every good hash function follows four rules, and each one matters for your money. Same input, same output. A tiny change gives a totally different output. You can't run it backwards. And no two inputs should ever share a fingerprint. Let's take them one at a time. > Four rules hold the whole thing together. Rule one: same input, same output. Run the words Pay Sam ten through SHA-256, and you get a code that starts e, one, e, b, six, one, four, nine. Do it on any computer, anywhere in the world, and you'll get exactly the same code. That's what lets thousands of strangers check the same block and agree. > Same input anywhere, same fingerprint. Rule two: change anything, and the fingerprint changes completely. Add one zero, so it says Pay Sam one hundred, and the code now starts two, c, three, zero. Nothing in common with the first one. Even making the first letter lowercase gives a totally different code. There's no such thing as a little bit different. Any change at all, and it's unrecognizable. > Any change makes it unrecognizable. Think of it like an avalanche. One pebble shifts, and the whole slope comes down in a completely new shape. That's exactly what makes a hash useful as a seal. You can't nudge it a little to hide a small change. > You can't nudge a hash a little. Rule three: you can't run it backwards. Going from input to hash takes a fraction of a second. Going from a hash back to the input is, in the words of the standard, computationally infeasible. It's like a blender. Making the smoothie is easy. Getting the strawberries back out is not. > Easy forward. Impossible backward. Rule four: no two inputs should share a fingerprint. In theory, matches must exist, because there are endless possible inputs and a fixed number of codes. But SHA-256 has roughly ten to the seventy-seventh power possible outputs. That's a one followed by seventy-seven zeros. Finding two inputs with the same fingerprint, on purpose, is again computationally infeasible. > No practical way to find twins. ## You already use hashes You've probably used hashes for years without knowing it. Well-run websites don't store your actual password. US security guidelines tell them to store a salted hash of it instead. When you log in, they hash what you typed and compare the two. That's why real support can never tell you your password. They don't have it. > Real support never has your password. One common mix-up: hashing isn't encryption. Encryption locks data so someone with the right key can unlock it later. A hash can't be unlocked by anyone, because the original was never inside it. Encryption hides things. Hashing proves things. > Encryption hides. Hashing proves. ## From the inside out So how does this hold a blockchain together? Let's build a block's fingerprint from the inside out. There are two steps: first the transactions, then the header. First, every transaction in the block is hashed. Then those hashes are paired up and hashed together, and paired again, and again, until a single hash is left. It's called the Merkle root, and it's the summary of every transaction you saw in the block header last lesson. Change one transaction anywhere in the block, and that root changes. > Change one payment, and the root changes. Then the header itself is hashed, and that header includes the previous block's hash. So each block's fingerprint depends on its own transactions, and on the block before it, which depends on the block before that. One fingerprint quietly vouches for the entire history behind it. > One fingerprint vouches for all of history. Now replay last lesson's attack, with real hashes. Change one old transaction. Its hash changes, so the Merkle root changes, so the block's hash changes, so the next block's record of the previous hash no longer matches. That's what tamper-evident means. The math gives it away instantly. > The math gives tampering away instantly. Here's a real one. The hash of Bitcoin's very first block begins with ten zeros. That's not luck. Bitcoin only accepts a block if its hash falls below a target number, and a smaller number means more zeros at the front. Finding a hash like that takes enormous trial and error. That's mining, and it gets its own lesson in this series. > Lots of zeros means lots of work. Not every network uses the same function. Bitcoin runs SHA-256 twice in a row for its block and transaction fingerprints. Ethereum uses a different one, called Keccak-256\. Different recipes, same job: any change, and the fingerprint gives it away. > Different recipes, same job. You'll meet hashes every time you use crypto. When you send a payment, your wallet shows a transaction ID, a long string of letters and numbers. That ID is a hash of your transaction. It's the receipt anyone can look up on a block explorer. > Your transaction ID is a hash. ## Hashes that protect you Now let's turn all this into something that protects you. One of the oldest tricks in crypto is a fake wallet app or a tampered download that looks exactly like the real thing. Hashes give you a way to check. This is the most practical thing in the whole lesson. > Looks identical isn't the same. This isn't theoretical. Security researchers found twenty-six fake apps on a major official app store, copying the names and icons of popular wallets. Once installed, they could steal recovery phrases and drain wallets. Even an official store isn't proof that an app is real. > An official store isn't proof. On a computer, there's a stronger check. Many wallet makers publish the SHA-256 fingerprint of each official download. After you download, you run the file through SHA-256 on your own machine and compare the two. If they match, the file is exactly what the maker published. > Match means it's exactly what they published. And here's what a mismatch looks like. The maker's fingerprint starts with one set of characters. Yours starts with something completely different. Remember rule two: any change to a file changes the whole hash. So if they don't match exactly, stop. Don't install it. Delete it and download again from the source you typed in yourself. > No exact match? Don't install. One caution. A hash only proves the file matches the fingerprint on the page. If an attacker controls the page, they can swap both. That's why careful wallet makers also digitally sign their fingerprint lists, and why you should only ever start from an address you typed yourself. Check the source first, then the fingerprint. > Check the source first, then the fingerprint. On a phone, you can't easily hash an app yourself. So use the next best checks. Get the store link from the wallet maker's own website. Check the publisher's name matches the real company. And if you're creating a new wallet, walk away from any app that asks you to type in a recovery phrase. A new wallet gives you a phrase. It never asks for one. > A new wallet gives you a phrase. It never asks for one. ## What hashes can't do One last limit to know. Hashes protect data from being quietly changed. They can't protect a secret you hand over yourself. If you type your recovery phrase into a fake site, no fingerprint anywhere will save you. The math guards the ledger. You guard the keys. > The math guards the ledger. You guard the keys. So here's your hash habit, in three steps. Start from an address you typed yourself. Check the fingerprint or the publisher before you install. And never type your recovery phrase into anything except the wallet you're restoring. Five extra minutes at install time can save everything you hold. > Five minutes at install can save everything. ## Hashing in four lines Here's the whole lesson in four lines. A hash is a fixed-size fingerprint of any data. Change anything, and the fingerprint changes completely. You can't run it backwards or find two that match. And because each block holds the last block's hash, the past can't be changed without everyone seeing. Same fingerprint, same data. That's the whole trick. > Same fingerprint, same data. ## Sources - [NIST FIPS 180-4 Secure Hash Standard: SHA-256 produces a 256-bit message digest; any change to a message will very likely produce a different digest; it is computationally infeasible to find a message for a given digest or two messages with the same digest. Example digests in this lesson (for 'Pay Sam 10', 'Pay Sam 100', 'pay Sam 10') were computed with a standard SHA-256 tool (sha256sum)](https://csrc.nist.gov/files/pubs/fips/180-4/final/docs/fips180-4.pdf?ref=cryptowithblock.com) - [NIST IR 8202: SHA-256 output is 32 bytes, shown as 64 hex characters; about 2^256 (roughly 10^77) possible digests; similar inputs give unrelated digests; hash functions are one-way and collision resistant; blocks chain via the previous header's hash and any change alters every later hash; block headers can hold a Merkle root](https://arxiv.org/pdf/1906.11078?ref=cryptowithblock.com) - [Bitcoin block headers contain the previous block header hash and a Merkle root built by pairing and hashing TXIDs with SHA256(SHA256()); a header hash must be at or below the target](https://developer.bitcoin.org/reference/block%5Fchain.html?ref=cryptowithblock.com) - [Bitcoin requires block hashes below a target, which means leading zeros; target adjusts every 2016 blocks](https://learnmeabitcoin.com/mining?ref=cryptowithblock.com) - [Bitcoin genesis block hash 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f (ten leading zeros)](https://www.utwente.nl/en/ces/sal/exams/Blockchain-and-Distributed-Ledger-Technology-test/1-Bitcoin/genesis-block-bitcoin-wiki.pdf?ref=cryptowithblock.com) - [A Bitcoin TXID is created by hashing the transaction data (SHA-256 twice) and is used to look transactions up in a block explorer](https://learnmeabitcoin.com/guide/txid?ref=cryptowithblock.com) - [Ethereum's execution specification uses keccak256 as its hash function](https://ethereum.github.io/execution-specs/src/ethereum/crypto/hash.py.html?ref=cryptowithblock.com) - [Wallet makers publish SHA-256 hashes of official installers so users can confirm a download is authentic and untampered; the hash list itself is signed](https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic?ref=cryptowithblock.com) - [Kaspersky found 26 fraudulent apps on a major official app store imitating popular crypto wallets and stealing recovery phrases; advises verifying the publisher and using download links from the developer's official website](https://kaspersky.co.uk/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets?ref=cryptowithblock.com) - [NIST SP 800-63B guidance requires verifiers to store passwords (memorized secrets) using secure salted hashing](https://pages.nist.gov/800-63-3-Implementation-Resources/63B/Authenticators/?ref=cryptowithblock.com) *Education only. Not financial advice.*