Generally speaking, a hashing function maps data of an arbitrary size (called a message, or initialization vectors) to data of a fixed size (called a digest):

const digest = MD5(message);

When used in a security context, a hashing algorithm is used to obfuscate a piece of information, such as a password.

For example, if we use the hashing function MD5 to hash the passphrases healer cam kebab poppy and peppermint green matcha ceylon, it will produce the hash digests b9f624315c5fb5dca09aa194091fccff and e6d4da56a185ff78721ab5cf07790a2c. Both digests have a fixed size of 128 bits (represented as hexadecimal) and both strings look pretty random. The MD5 algorithm also has the property of being deterministic, which means if we run the algorithm using the same message again, it will always produce the same digest.

Therefore, in theory, when the user first registers, we can require the client to hash their password before sending it over to the server; this way, no one except for the client will know what the original password is. The server would then store the digest in the database.

The next time the same user wishes to authenticate with the server, they should again hash the password and send the digest to the server. Because MD5 is deterministic, the same password should result in the same digest. This allows the server to compare the digest provided in the request with the digest stored in the database; if they match, the server can authenticate the user, without knowing what the password actually is.