Most storage systems answer the question “where is this data” with a path or a location: a file path, a table row, a memory offset. Content-addressable storage (CAS) answers a different question entirely. It asks “what is this data” and uses the answer as the address. Give it a blob of bytes, run it through a cryptographic hash function, and the resulting digest becomes the key you use to retrieve that exact blob later. No path, no location, just the content’s own fingerprint.

This sounds like a small inversion, but it has quietly become one of the more load-bearing ideas in modern infrastructure. Git, Docker, IPFS, most backup and dedup systems, and a good chunk of package managers all lean on it.

What Content Addressing Actually Means

In a traditional filesystem, you might store a file at /photos/vacation.jpg. If you change even one pixel, the path stays the same but the content underneath it changes. That’s fine for most everyday use, but it means the path tells you nothing about whether the content has changed, and two identical files stored at different paths look like two completely unrelated pieces of data.

In a content-addressable system, that same file gets hashed (commonly with SHA-256 or a similar algorithm), and the hash becomes its identifier. Store the file again under a different name, and it produces the same hash, so the system recognizes it’s already there. Change one pixel, and the hash changes completely, so it’s stored as a distinct object. The address and the content are locked together by math, not by convention.

Why Immutability Is the Whole Point

Once an object’s address is derived from its content, that object can never be silently modified in place. If you change the bytes, you get a new address. This gives CAS systems a property that’s hard to bolt onto path-based storage after the fact: any two systems that compute the same hash for the same input are guaranteed to be looking at identical data, without needing to trust each other or compare the full contents byte by byte.

That’s the property Git relies on when it deduplicates commits and blobs across branches and clones. It’s what lets Docker layers be shared across images without re-downloading identical layers. It’s the basis for how peer-to-peer systems like IPFS verify that a file fetched from an untrusted peer hasn’t been tampered with, since the retrieved content has to hash back to the address you asked for or something is wrong.

Where It Shows Up

Beyond the obvious examples, content addressing underlies a lot of infrastructure that doesn’t advertise it. Deduplicating backup systems chunk files into blocks, hash each chunk, and only store chunks whose hash hasn’t been seen before, which is why incremental backups of largely unchanged data sets can be so much cheaper than a naive copy. Package managers and build systems use content hashes to cache build artifacts, so a build step only reruns if its inputs actually changed. CDNs and artifact registries use content hashes to make cache keys collision-proof, since two different pieces of content essentially never produce the same hash.

The Tradeoffs Nobody Advertises

CAS isn’t free. Hashing every object costs CPU, which matters at scale. Content-addressed stores also tend to accumulate garbage, since old versions of data don’t get overwritten, they just become unreferenced objects that need a separate garbage collection pass to reclaim (this is exactly why git gc exists). Lookups by content also don’t naturally support range queries or ordering, so systems that need to browse data sequentially usually layer a separate index or naming scheme on top of the content-addressed store rather than relying on it alone.

There’s also a subtler cost: content addressing assumes the hash function itself is trustworthy. Collision resistance is a load-bearing assumption, which is why systems that started on older hash functions have had to plan migrations as those functions weakened over time.

None of this makes CAS a niche technique. It’s a foundational pattern precisely because deduplication and tamper-evidence are such common problems, and deriving identity from content instead of assigning it arbitrarily is a remarkably simple way to solve both at once.