1. Home
2. Trainers' Curriculum
3. Crypto Fundamentals
4. Hashes
5. Working with Entropy

Deepening : Hashes

Credits Jon Camfield, Robert J. Hansen   Last Updated 2026-08

ADIDS Element

Parent Topic(s)

Duration

Materials

• Participants should download and install QuickerHah. Participants who don’t want to install any new software can reference the command line tool guidance below on all platforms.

Deepening

All modern operating systems have built in hash creation/verification tools, but they are command-line based. In this session, we will use a graphical tool called QuickerHash, but we will also provide command-line options for users who are willing to use the command line and/or don’t want to download additional software.

Hash Functions

First off, as soon as you start playing with these tools, you full find that there are tons of different hashes you can choose from.

For normal files, passwords, and text, the most common hash algorithms you’ll see are likely MD, SHA-1, and SHA-256, and more recently, SHA-384. Of these, MD5 as mentioned suffers from (relatively) easy collisions, and SHA-1 has been more recently found vulnerable to some collision attacks. Note: You may also see “SHA-2”, which is a family of hashing algorithms of which SHA-256 and SHA-384 are the most ‘popular’ specific algorithms. To make things even more clear, there is also SHA-3, which similarly has a variety of bit length, like SHA3-384.

Looking at hashing algorithms for password security, the more advanced tools (classed as Key Derivation Functions), are used - these combine multiple technologies to ensure a baseline of entropy and are built to be very slow to brute force at scale. Examples include bcrypt and scrypt.

Wikipedia maintains an article with a chart of the security of these most used hash algorithms, and a similar one for Key Derivation Functions

Hashing using QuickerHash

Quickerhash was explicitly created for digital safety trainers by Robert J. Hansen. Feedback, suggestions, and requests for changes or improvements are strongly encouraged via adding a github issue.

Downloads are available for MacOS (.dmg files), Windows (.msi) and Linux (.rpm). See the readme for additional installation instructions.

Let’s get hands on and create and verify some hashes - first up, we’ll verify the hash of the quickerhash download file itself!

QuickerHash will start up with a small selection of very common hash algorithms pre-loaded. You can use the drop down menu for Hashes to select additional classes of hashes to experiment with.

Hashing Files

• On the QuickerHash Releases page, each file has a sha256: with the beginning of a sha256 hash showing, and a “copy” button. Click the copy button for the download you’re using (or download a new copy to do this test with).
• Open QuickerHash
• Select the Hash a File tab
• Select the quickerhash file you have downloaded
• Choose which hash you want to compute - in this case, the quickerhash releases use SHA-256
• Compare the hash it created with the hash from the website - you can review it manually, or for better accuracy, paste in the value from the website in the “expected value” field and see if they match.

Hopefully the values matched! If not, verify you used the same hash algorithm, and are comparing the same downloaded file for both the operating system (Linux, MacOS, Windows) AND version that you downloaded.

Text Hashing

• Open QuickerHash
• Select the Hash Text tab
• Choose which hash you want to compute
• Type in text to the text box
• See the hash value in the the grey box below.
• Try a few common strings like Password vs password vs Password! and see how different the hash values are.
• Try a few different algorithms to see how they look, and how long they are (independent of how long your text is!)

Command Line Tools

Windows

In Powershell (v4 or above), you can use the Get-FileHash ‘cmdlet’ for producing hash values. For files:

Get-FileHash C:\Users\user1\Downloads\Contoso8_1_ENT.iso -Algorithm SHA384 | Format-List

Powershell unfortunately does not provide a simple way to compute a hash for a string. With a little work, you can get this set up however:

Within PowerShell, type:

> $profile

… and it will give you back the name of your PowerShell startup file. This file gets executed every time you start PowerShell. Open it in your preferred text editor, add this block of code, save, and exit.

function Get-StringHash
{
  param(
    [Parameter(Mandatory=$true)]
    [string] $Text,
    [ValidateSet("MD5", "SHA1", "SHA256", "SHA384", "SHA512")]
    [string] $Algorithm = "SHA256"
  )
  $stream = [System.IO.MemoryStream]::new()
  $writer = [System.IO.StreamWriter]::new($stream)
  $writer.write($Text)
  $writer.flush()
  $stream.position = 0
  return Get-FileHash -InputStream $stream -Algorithm $Algorithm
}

You now have a Get-StringHash cmdlet that works pretty much identically to Get-FileHash. E.g.,

> Get-FileHash C:\Users\user1\Downloads\disk_image.iso -Algorithm SHA256
> Get-StringHash "Hello, world!" -Algorithm SHA256

MacOS and Linux

In your Terminal program or directly in a command line, you have a variety of options in both OSX and Linux to check hashes. The most flexible is the openssl tool (it can also do a wide variety of other cryptographic tricks!).

You can get a list of all the hash functions openssl supports with

openssl dgst -list

To get a hash of a short text string, use this command, replacing FOOBAR with your text (and selecting the hash, here using SHA-3)

printf FOOBAR | openssl dgst -sha3-256

To get a hash of a file, use this command, replacing FILENAME with the path to the file you want to hash (and selecting the hash, here using SHA-3):

openssl dgst -md5 FILENAME

Of note, in Ubuntu, you can also install nautilus-gtkhash (in Ubuntu 22 and before) or Quick File Hasher to add a right-click menu tab that will generate hashes for you in the file manager GUI.