Blog · July 13, 2026
Hashing vs. Cryptography: SHA, SimHash, and Diffie-Hellman Explained
People mix these up constantly. Hashing and cryptography both touch security, both involve turning data into something else, but they solve completely different problems. One’s for checking and identifying data. The other’s for keeping it secret.
Here’s SHA, SimHash, and Diffie-Hellman, and where each one actually gets used.
SHA: Turn Anything Into a Fixed-Length Fingerprint
Quick distinction first: the hash functions used in hash tables map a value to an array index. SHA is a different kind of hashing: it takes an input, like a string or a file, and produces a fixed-length hash value that acts like a fingerprint for that input.
Use case 1: checking if two files are identical
Download an installer, and a software provider might publish its official SHA hash. Calculate the hash of your download yourself, compare it to the published one. Match means identical file. That’s how you verify a download hasn’t been tampered with or corrupted.
Use case 2: storing passwords without storing passwords
Systems don’t (or shouldn’t) store your actual password. They store its hash. When you log in, the system hashes what you typed and compares it to the stored hash. Match means correct password, and the original password never needed to sit in the database at all.
The property that makes this work: you can generate a hash from an input easily. Going backward, recovering the original input from the hash, isn’t supposed to be feasible. That one-way property is the whole point.
If you want to go deeper here: SHA family algorithms and bcrypt are the two things worth reading up on next.
SimHash: When You Want Similar Inputs to Produce Similar Hashes
SHA is deliberately locality-insensitive. Change one character in the input, and you get a completely different hash. That’s a feature for SHA’s job: you want tiny tampering to be obvious.
But sometimes you want the opposite. You want two similar inputs to produce similar hashes, so you can detect that they’re similar in the first place.
That’s locality-sensitive hashing, and SimHash is a well-known example.
The core difference:
- SHA: small input change leads to a wildly different hash
- SimHash: small input change leads to only a slightly different hash
That property makes SimHash useful for spotting near-duplicate content, pages that are almost the same but not byte-for-byte identical. Google uses it for exactly this while crawling the web, to catch duplicate or near-duplicate pages.
Diffie-Hellman: Talking Securely Over an Insecure Line
This is where hashing and cryptography actually diverge. Hashing checks and identifies data. Cryptography protects it in transit.
Diffie-Hellman solves a specific problem: how do two parties establish secure communication over a channel that isn’t secure, where someone could, in theory, be listening the whole time?
It works with a public key and a private key. The public key can be shared with anyone, no risk. The private key stays secret. A message encrypted with the public key can only be decrypted with the matching private key, so even if someone intercepts the encrypted message, they can’t read it without the private key.
If cryptography is the direction you want to go next, Diffie-Hellman and RSA are the two to start with.
Hashing vs. Cryptography: The Actual Difference
| Hashing | Cryptography | |
|---|---|---|
| Purpose | Compare, verify, and identify data | Protect data and enable secure communication |
| Reversible? | No, one-way by design | Yes, decryption is the point |
| Example use | Checking downloads, password storage, duplicate detection | Secure messaging, key exchange |
Knowing which one you actually need matters. Hash a password, and you can verify a login without ever storing the real password. Try to “hash” a message you need to read back later, and you’ve built something that doesn’t work: hashing was never meant to be reversed. That’s cryptography’s job.
FAQ
What is SHA used for?
Producing a fixed-length hash from an input, mainly to verify file integrity (comparing downloads against a published hash) and to store passwords securely without keeping the original password.
Can a SHA hash be reversed to get the original input?
No. Generating a hash is a one-way process. That’s the property that makes it useful for password storage and file verification.
What is locality-sensitive hashing?
A hashing approach where similar inputs produce similar hashes, unlike SHA, where a tiny change in input produces a completely different hash. SimHash is one example.
What is SimHash used for?
Detecting near-duplicate content. Google uses it while crawling the web to identify duplicate or near-duplicate pages.
What does the Diffie-Hellman algorithm do?
It lets two parties establish secure communication over an insecure channel, using a public key that can be shared freely and a private key that stays secret.
What’s the difference between hashing and cryptography?
Hashing is one-way and used to compare, verify, or identify data. Cryptography is reversible (with the right key) and used to protect information during communication.