Can I use both hashing methods together?

Yes, and this is the recommended approach for thorough image management. Use cryptographic hashing (SHA-256) first to find exact duplicates — files that are byte-identical. Then use perceptual hashing (dHash) on the remaining images to find near-duplicates that differ only in compression, resolution, or minor edits. This two-pass approach catches both exact copies and visual duplicates.

Which hash should I use for evidence preservation?

SHA-256 cryptographic hashing. Legal and forensic workflows require proof that a file has not been modified in any way — not even a single byte. Perceptual hashes cannot provide this guarantee because they are designed to tolerate changes. SHA-256 is the current standard for chain-of-custody documentation and evidence integrity verification.

Why does resizing a photo change the cryptographic hash but not the perceptual hash?

Cryptographic hashes process every byte of the file. Resizing changes all pixel data, producing a completely different hash. Perceptual hashes first reduce the image to a tiny grid (9x8 for dHash) — both the original and the resized version reduce to essentially the same grid because the structural pattern is preserved. The perceptual hash captures visual structure, not file data.

Perceptual vs Cryptographic Hashing: When to Use Each

Q: Is perceptual hashing secure?

Perceptual hashing is not designed for security. It is designed for similarity detection. An adversary can deliberately craft images that produce a target perceptual hash. For security-critical applications — software verification, evidence integrity, tamper detection — always use cryptographic hashing (SHA-256 or stronger).

Q: What is Hamming distance?

Hamming distance counts the number of positions where two binary strings differ. For 64-bit perceptual hashes, a Hamming distance of 0 means identical hashes, 1-5 indicates near-duplicates, and above 10 typically means different images. It is the standard metric for measuring perceptual hash similarity.

Two Types of Fingerprints

Both cryptographic and perceptual hashing reduce data to compact fingerprints. But they're engineered for opposite goals, and conflating them leads to bad decisions.

Try it free: File Hash Scanner — Generate and compare cryptographic file hashes. Runs in your browser, no signup needed.

Cryptographic hashing (SHA-256, MD5, SHA-512) processes every byte of a file and produces a fixed-length digest. Change a single bit and the hash changes completely — the avalanche effect. This is by design: cryptographic hashes verify that two files are exactly, byte-for-byte identical. Our File Hash Scanner computes MD5, SHA-1, SHA-256, and SHA-512 simultaneously.

Perceptual hashing (dHash, pHash, aHash) analyzes what an image looks like — its visual structure — and produces a fingerprint that stays similar even after resizing, recompression, color shifts, and minor edits. Two photos of the same scene produce nearly identical hashes regardless of file format or resolution. The Duplicate Scanner uses dHash to find near-duplicates across up to 50 images.

The Core Difference: Sensitivity

Cryptographic hashes are maximally sensitive. Save a JPEG at quality 90 instead of 92, and the SHA-256 hash is completely different — every byte changed. Rotate an image by one degree, re-encode it, add a comment to the metadata — different hash every time. This sensitivity is the point: any alteration, no matter how small, is detected.

Perceptual hashes are deliberately insensitive. Save at quality 90 or 92 — same hash. Resize from 4000×3000 to 800×600 — same hash. Shift the white balance, increase the brightness, convert from JPEG to PNG — same hash (or only 1-2 bits different). The perceptual hash sees through surface changes to the underlying visual structure.

This difference means you must choose the right tool for the right question. Using SHA-256 to find "photos that look the same" will fail — it'll tell you every re-saved copy is completely different. Using dHash to verify file integrity will fail — it'll tell you a tampered file is "the same" because the visual structure didn't change enough.

💡 Did you know?

A 20-megapixel photo contains about 60 million pixel values. SHA-256 uses all of them (plus metadata bytes) to produce a 256-bit hash. dHash ignores everything except a 9×8 grayscale grid — just 72 pixel values — to produce a 64-bit hash. That extreme compression is what makes perceptual hashing tolerant of changes.

When to Use Cryptographic Hashing

File integrity verification. You downloaded a Linux ISO or a software installer. The publisher lists a SHA-256 hash. You compute the hash of your downloaded file and compare — if they match, the file wasn't corrupted or tampered with during transfer.

Evidence preservation. In legal and forensic contexts, SHA-256 hashing establishes that a file has not been modified since a specific point in time. The hash becomes part of the chain-of-custody documentation. Any alteration — even adding a metadata comment — would break the hash.

Exact duplicate detection. If you need to find files that are bit-identical copies (same file saved in two locations), cryptographic hashing is fast and conclusive. Two files with the same SHA-256 are the same file, period.

Data deduplication. Storage systems and backup tools use cryptographic hashes to identify redundant copies and eliminate them, saving space without risking data loss. For deeper context, see our guide on what file hashes are and how they work.

See perceptual hashing in action — upload up to 50 photos and find near-duplicates instantly.

Find Duplicate Photos →

When to Use Perceptual Hashing

Photo library cleanup. You have 30 burst shots, plus resized copies for social media, plus backups at different JPEG quality levels. Cryptographic hashes say they're all different. Perceptual hashing groups them as the same photo, letting you keep one and delete the rest.

Copyright monitoring. Someone re-uploads your photo after resizing it, converting to WebP, and adding a watermark. The cryptographic hash is completely different. The perceptual hash is still within Hamming distance 3 — a confirmed match despite the modifications.

Content moderation. Platforms hash known harmful images and block re-uploads. Perceptual hashing catches re-encoded, resized, and slightly modified versions that cryptographic hashing would miss entirely.

Batch deduplication. The Batch Scanner uses both approaches: SHA-256 for exact matches and perceptual hashing for visual similarity. Running both in one pass gives you the complete picture. Read more about the dHash algorithm in our perceptual hashing explained.

Head-to-Head Comparison

Property	Cryptographic (SHA-256)	Perceptual (dHash)
Output size	256 bits (64 hex chars)	64 bits (16 hex chars)
Sensitivity	1 bit change → completely different hash	Resize, recompress → same or similar hash
Input	Entire file (pixels + metadata)	Visual content only (9×8 grayscale grid)
Comparison metric	Exact match (yes/no)	Hamming distance (0–64 scale)
Best for	Integrity, evidence, exact duplicates	Visual duplicates, similarity, copyright
Security	Tamper-evident (collision-resistant)	Not security-grade (forgeable)

Using Both Together

The strongest approach uses both methods in sequence. First, compute SHA-256 hashes for every file and group exact duplicates — these are safe to deduplicate because they're proven identical. Second, compute perceptual hashes on the remaining unique files and group near-duplicates by Hamming distance — then manually review which visual duplicates to keep.

For pixel-level comparison between specific image pairs — especially when you need to see exactly which regions changed — the Similarity Scanner provides side-by-side diff heatmaps that neither hashing method can offer. See our guide on image similarity comparison for the full range of options.

Common Questions

Can I use both methods together? Yes — use SHA-256 first for exact duplicates, then dHash for visual near-duplicates. The Batch Scanner computes both in a single pass.

Which hash for evidence preservation? SHA-256. Legal workflows need proof that a file hasn't changed at all. Perceptual hashes can't guarantee this because they're designed to tolerate changes.

Why does resizing change the cryptographic hash but not the perceptual hash? Cryptographic hashes process every byte — resizing changes all of them. Perceptual hashes reduce to a tiny grid first — both the original and resized version produce essentially the same grid.

Is perceptual hashing secure? No. It's not designed for security. Adversaries can craft images targeting a specific perceptual hash. For security-critical use, always use SHA-256.

What is Hamming distance? The number of bit positions where two hashes differ. For 64-bit perceptual hashes: 0 = identical, 1–5 = near-duplicate, 10+ = different images.

Different Questions, Different Tools

"Has this file been altered?" — use SHA-256. "Does this photo look the same as that one?" — use dHash. Two questions, two tools, zero overlap. Using the right one for the right job is the entire difference between finding what you're looking for and missing it completely.