Hashing with MessageDigest in Java

A cryptographic hash function takes data of any size and produces a short, fixed-size value called a hash or digest, which acts as a fingerprint of the data. The same input always gives the same hash; changing even one character gives a completely different one; and there is no way to work backward from the hash to the data. In Java, hashing is done with the class java.security.MessageDigest, and the standard algorithm today is SHA-256. In this lesson, you will learn how to compute a hash, the properties that make hashes useful, where they are used, and why a plain hash is not the right way to store passwords.

Properties of a Cryptographic Hash

Methods of MessageDigest

A hash is bytes. To show or store it as text, convert it to hexadecimal with HexFormat.of().formatHex(bytes) or to Base64.

Example: Computing SHA-256

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
 
public class Hashing {
    static String sha256(String text) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] hash = md.digest(text.getBytes(StandardCharsets.UTF_8));
        return HexFormat.of().formatHex(hash);
    }
 
    public static void main(String[] args) throws Exception {
        String a = sha256("Navika scored 91 marks");
        String b = sha256("Navika scored 91 marks");
        String c = sha256("Navika scored 92 marks");
        System.out.println(a);
        System.out.println("Same input, same hash?   " + a.equals(b));
        System.out.println(c);
        System.out.println("One digit changed, same? " + a.equals(c));
        System.out.println("Hex length: " + a.length()
            + " characters = 256 bits");
        System.out.println("Empty text:  " + sha256("").substring(0, 16)
            + "...");
        System.out.println("Long text:   "
            + sha256("x".repeat(1_000_000)).length() + " characters");
 
        // Feeding data in pieces gives the same result as all at once.
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        md.update("Navika scored ".getBytes(StandardCharsets.UTF_8));
        md.update("91 marks".getBytes(StandardCharsets.UTF_8));
        String pieces = HexFormat.of().formatHex(md.digest());
        System.out.println("In two pieces, same?     " + a.equals(pieces));
 
        // Comparing two hashes safely.
        byte[] x = HexFormat.of().parseHex(a);
        byte[] y = HexFormat.of().parseHex(b);
        System.out.println("MessageDigest.isEqual:   "
            + MessageDigest.isEqual(x, y));
 
        for (String name : new String[] {"MD5", "SHA-1", "SHA-256",
                "SHA-512", "SHA3-256"}) {
            int bits = MessageDigest.getInstance(name).getDigestLength() * 8;
            System.out.println(name + ": " + bits + " bits");
        }
    }
}

618f91c289f43eeadfed8328be71e0c5ee2954c98f0d337ef1999f7d71332ee0
Same input, same hash?   true
7275d712c48d67dbb02012b7cccad6a24afdf3671740c786016c64488e9a526f
One digit changed, same? false
Hex length: 64 characters = 256 bits
Empty text:  e3b0c44298fc1c14...
Long text:   64 characters
In two pieces, same?     true
MessageDigest.isEqual:   true
MD5: 128 bits
SHA-1: 160 bits
SHA-256: 256 bits
SHA-512: 512 bits
SHA3-256: 256 bits

Explanation:

1. The first hash is 64 hexadecimal characters: 32 bytes, 256 bits.
2. The same text hashed again gives the identical value.
3. Changing "91" to "92" produces a hash with nothing visibly in common with the first. That is the avalanche effect.
4. Size never changes: the empty string and a million-character string both give 64 characters.
5. update lets you feed data piece by piece, for example while reading a large file, without holding it all in memory. The result is the same as hashing it at once.
6. MessageDigest.isEqual compares two hashes without revealing, through timing, how many leading bytes matched.
7. The last lines list common algorithms and their sizes.

Which Algorithm?

What Hashing Is Used For

What Hashing Is Not

Common Mistakes

Calling text.getBytes() without a character set. Different machines may produce different bytes, and so different hashes. Always pass StandardCharsets.UTF_8.

Using MD5 or SHA-1 for anything security-related. Both are broken.

Storing passwords as a plain SHA-256 hash. It is far too fast to resist guessing.

Comparing hashes as strings with equals in security checks. Use MessageDigest.isEqual.

Sharing one MessageDigest between threads. It isn't thread-safe; create one per use.

Interview Corner

Practice

1. Easy: Print the SHA-256 and SHA-512 hashes of your name and compare their lengths.
2. Harder: Write a method that returns the SHA-256 hash of a file, reading it in 8 KB chunks with update.

Key Takeaways