What "dropping a hash" actually means
In security circles, "dropping a hash" is a common way to publicly prove you possessed certain information at a specific point in time. The technique is simple, relies on well-established mathematics, and anyone can use it — but it's rarely explained outside the community. Here's how it works.
The properties behind the trick
A cryptographically secure hashing algorithm like SHA-512 takes any data — a document, a photo, a video — and produces a short, fixed-length string of characters. That string is the data's "hash." Change even one character in the original data and the hash changes completely.
For example, this is a SHA-512 hash of the sentence "This is what a hash looks like.":
9ca61274537c9f9398bcd74f3d21c1ae5df50737764e2ddbaa2ede6a779c8871fb1b3a31794bbf3b2fc5103421e9ee83646df0b83363afbec2e9c7e67b881b88
Remove the period and the hash becomes:
19e38c497fa028936823325fb6a57f25142f25152f5b086882c0fa38ab885538d364ffd8941cde001033b4d99d4fc5f35ea66d08d060fb6dd959b3d36f518e04
These hashes are effectively irreversible and collision-resistant. Given a hash, you cannot work backward to the original text without already knowing it exactly. Producing two different documents with the same hash is considered computationally impossible, even with extraordinary resources. The security of much of the internet depends on this property, so it's fair to say a material portion of the global economy is staked on it.
A tool for claiming credit
Security researchers sometimes uncover dangerous vulnerabilities — for example, a way to break into a major company's systems. Publishing those findings immediately could enable abuse. Informing the company quietly first is responsible, but it doesn't help the researcher's professional reputation. A discovery of that magnitude is a significant career achievement, similar to a major scientific result. It can lead to job offers, consulting work, or public recognition.
But if the company fixes the issue and tells the world, how can the researcher credibly claim they found it first?
This is where the hash comes in. The researcher writes up their findings, publishes only the SHA-512 hash of that document in a public forum, and then privately reports the vulnerability to the company. Once the fix is public, the researcher publishes the full research, pointing back to the earlier hash. Anyone can then verify with near-certainty that the document existed at the time the hash was published.
This isn't a handshake or an honor-system ritual. It's a reproducible technology that anyone can use, backed by mainstream cryptographic science.
How to verify a dropped hash
To check a dropped hash, download the file in question and calculate its hash using the same algorithm the author used — typically indicated by the hash's length and format, with SHA-512 being a common choice. Then compare your result against the hash that was previously posted somewhere it cannot be altered, such as a mailing list or Twitter.
On modern operating systems, the shasum utility can do this:
shasum -a 512 name-of-the-file.txt
If the outputs match exactly, you know the file is the same one the author held when the hash was dropped, and that it has not been tampered with in the meantime.
