get back value from Hashed value? get back value from Hashed value? database database

get back value from Hashed value?


There are exactly 2^32 many hash codes but way, way more strings. Thus, by the pigeonhole principle, there have to be multiple strings mapping to the same hash code. Therefore, an inverse map from hash code to string is impossible

Edit: Response to your update.

actually i am thinking to save password into my database after hashing to make it secure...

So it means a different password even have same value?

Yes, it is possible for two passwords to have the same hash. This is basically a restatement of the above. But you shouldn't use GetHashCode to hash the password. Instead, use something secure like SHA-2.

To go one step further, never try to roll your own your encryption/security etc. Find a library that does it for you.


actually I am thinking to save password into my database after hashing to make it secure

You are not competent to implement this code.

That's nothing to feel bad about. I'm not competent to do so either, and I've studied security systems for years. By studying security systems I've learned that security systems are insanely difficult to get right, require years of experience and detailed expertise of a complex domain. That's how I know I'm not competent. The fact that you think that hashes might be reversible indicates to me that you are not a security professional.

My advice: hire a security professional to do this task for you. There is no point in spending good money to make a bad security system that doesn't actually protect your resources. Rather than rolling your own cheap system now and spending a lot more money on cleaning up the disaster later, spend a little more up front now and get a professional implementation.

Furthermore, the documentation for GetHashCode specifically states that it is not suitable to be used for password hashing because the algorithm could be changed at any time. In fact the hash algorithm did change between CLR v1 and CLR v2, and that broke every single vendor who relied upon GetHashCode for a password hash who upgraded their system. GetHashCode is not stable, it is not secure, it is not crypto strength and it is not based on any industry standard algorithm. DO NOT UNDER ANY CIRCUMSTANCES use it for crypto hashing.


One answer that is missing here is explaining to the OP that hashing is not encryption. The terms hashing and cryptography are often confusing for junior programmers (myself included at one point) who need to deal with security for the first time.

  • From Wikipedia: A hash function is any well-defined procedure or mathematical function that converts a large, possibly variable-sized amount of data into a small datum, usually a single integer that may serve as an index to an array (cf. associative array). The values returned by a hash function are called hash values, hash codes, hash sums, checksums or simply hashes.
  • From Wikipedia: Encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key.

Edit for Update:

  1. Yes. Though unlikely and highly dependent on the type of hash algorithm, hashing of two or more different pieces of data could yield the same value.
  2. Password hashing is often used to secure passwords in a database. But, you cannot un-hash passwords. If you want to hash them you have to evaluate the hash values to make sure they match. Here's and ASP-specific strategy for hashing passwords. Here is a good read, especially if you're working with web technologies