Hash
A hash function converts input data of any length into a fixed-length output (hash value or digest). The same input always produces the same hash, but reversing the process is computationally infeasible (one-way property). Even a single-bit input change dramatically alters the output (avalanche effect). SHA-256 and SHA-3 are widely used algorithms.
Change the input by a single character and the hash becomes an entirely different value (the avalanche effect). Taking only the first 16 digits of the SHA-256 output, it looks like this.
| Input | First 16 digits of the SHA-256 output |
|---|---|
| QR code | 2c24d35a117c162d |
| QR Code | 5a779155eadaaa3b |
| QR codes | f24e1b51e717a757 |
Hashes serve multiple roles around QR codes. In QR code payments, transaction data hashes combined with digital signatures detect tampering. The EU Digital COVID Certificate hashed vaccination data, signed the hash, and stored it in QR codes.
TOTP (one-time password) generation also relies on hashing. The secret key and current time are processed through HMAC-SHA1 to derive a 6-digit authentication code - QR codes transfer the secret key, hash functions generate the codes.
Checksums are conceptually related. QR code format and version information use BCH codes for integrity verification - the same principle of "verifying data correctness with a short value" runs from QR code internals through the application layer.
Where hashing shows up around QR codes.
| Where | How the hash is used | Purpose |
|---|---|---|
| QR code payments | A hash of the transaction data is combined with a digital signature | Detect tampering with the payment information |
| EU Digital COVID Certificate | The hash of the vaccination data was signed and stored in the QR code | Confirm the data had not been altered |
| TOTP (one-time password) | The secret key and the current time are processed with HMAC-SHA1 | Derive the 6-digit authentication code |
| QR code format and version information | Protected with BCH codes | Verify the integrity of the data |