Hashing vs Encryption
Hashing is a one-way function: it turns input into a fixed-size fingerprint that cannot be reversed. Encryption is two-way: it scrambles data that a key can later restore. They look similar and are constantly confused, but they solve opposite problems — and using one where you need the other is a genuine source of security bugs.
What is the core difference?#
Encryption protects confidentiality of data you need to read back later. It is reversible by design: the right key turns ciphertext back into plaintext. Use it for data at rest, messages in transit, and anything you must recover.
Hashing produces a fixed-length digest that cannot be reversed to the original. The same input always yields the same hash; a tiny change yields a completely different one. Use it to verify without storing — passwords, file integrity, digital signatures.
| Hashing | Encryption | |
|---|---|---|
| Direction | One-way | Two-way (reversible) |
| Needs a key | No | Yes |
| Purpose | Verify, fingerprint | Confidentiality |
| Passwords? | Yes (salted, slow) | Never |
| Examples | SHA-256, bcrypt, Argon2 | AES, RSA |
Why does the distinction cause real bugs?#
Because storing passwords with encryption instead of hashing is a catastrophe waiting to happen: one leaked key exposes every password. The correct approach hashes passwords with a deliberately slow, salted algorithm so that even the people running the system cannot recover them, and a stolen database is not an instant account-takeover kit.
Hashing underpins digital signatures and integrity in the CIA triad; encryption is covered in symmetric vs asymmetric encryption. More at the Security Fundamentals hub.
Frequently asked questions#
Can you decrypt a hash?
No — hashing is one-way by design, so there is no key that turns a hash back into the original. What attackers do instead is guess: hash enormous lists of candidate inputs and compare. That is why password hashes need salting and a slow algorithm, to make guessing impractical rather than to make reversing possible.
Should passwords be encrypted or hashed?
Hashed, never encrypted. Encryption is reversible, so an encrypted password database plus the key equals plaintext passwords. Hashing with a slow, salted algorithm like bcrypt, scrypt, or Argon2 means even the operator cannot recover the passwords, and a database breach does not immediately expose them.