I have been reading about password management lately (very interesting stuff!) and was wondering how different the hashes would be for similar strings.

Is it possible to know if a password guess was close by comparing the resulting hash to the real hash?

For example, if the real password is "password123" and a hacker tries "Password123", "password1234", "password124", etc., would the generated hashes be similar enough to the real hash that either the hacker or their computer could tell they were on the right track?

Let's assume that the hacker knows any salt, pepper, cayenne powder, adobo, whatever... If they try the right password they will generate a matching hash.

(I think this might vary depending on the hash function used, but I don't know this for sure.)

No, you cannot determine how close you guessed looking at the hash. A hash function is designed with this in mind: one single changed bit on the input must change a lot of bits on the output. Its called Avalanche Effect.

Bellow are SHA1 hashes for some of your example passwords:

cbfdac6008f9cab4083784cbd1874f76618d2a97 - password123

b2e98ad6f6eb8508dd6a14cfa704bad7f05f6fb1 - Password123

2b4bfcc447c3c8726d26c22927a68f511d5e01cc - password124

115b55dcc1cd9a0dfdd60c120e83eaf658c45fc6 - right horse battery staple

abf7aad6438836dbe526aa231abde2d0eef74d42 - correct horse battery staple


A single bit change will completely change the hashing result. In fact, in an ideal case for every bit of input change every bit of output will be changed with a 50% probability.
