Hashing creates a fixed-length fingerprint that is designed not to reveal its input; encryption conceals data in a form an authorized process can later recover. That distinction explains why systems typically verify passwords by comparing hashes instead of storing passwords that can be decrypted.
What hashing does
A hash function takes input data and produces a fixed-length output called a hash or digest. The input can be short or long; the digest has a defined length for the function being used. NIST defines a hash function as “a function on bit strings in which the length of the output is fixed.” NIST’s cryptographic hash-function glossary describes approved cryptographic hash functions as one-way and collision-resistant.
As an Amazon Associate I earn from qualifying purchases.
One-way means it should be computationally infeasible to find an input that produces a specified digest. Collision resistance means it should be computationally infeasible to find two different inputs with the same digest. These are security goals, not a promise that no input can ever be guessed: if the original is a common or weak value, someone can try likely inputs and compare their hashes.
Where hashes are useful
A digest gives systems a compact way to represent data or check whether data matches an expected value. It is not intended as a concealed version of the input that can be restored. Hashing can also appear inside larger cryptographic designs, but that does not make an ordinary hash function encryption.
#1 Best Overall
What encryption does
Encryption transforms readable plaintext into ciphertext to conceal its meaning. With reversible encryption, a corresponding decryption operation restores the original data. NIST describes encryption as transforming data to hide its meaning and identifies decryption as the operation that recovers it. See NIST’s encryption glossary.
Encryption is useful when data must remain confidential but still be available to an authorized process or person. Its defining feature here is recoverability through decryption, not a fixed-length fingerprint.
Hashing and encryption compared
| Question | Hashing | Encryption |
|---|---|---|
| Main purpose | Represent data or help check it against an expected value | Conceal data while allowing authorized recovery |
| Output | A fixed-length digest | Ciphertext, whose length depends on the encryption method and data |
| Can the original be recovered? | Not by reversing the hash; the design goal is computational infeasibility | Yes, through decryption in a reversible encryption system |
| Typical question it answers | “Does this input produce the expected digest?” | “How can authorized users recover this concealed data?” |
Why password systems hash instead of encrypting passwords
A login system generally needs to check whether a submitted password matches the one set for an account; it does not need to retrieve the original password. Storing encrypted passwords would preserve a recoverable secret. Instead, a password-hashing scheme can store a verifier and compare it with a value computed from the password entered at login.
How the comparison works
- When a password is set: The system applies a password-hashing scheme to the password, along with a salt and a cost factor, and stores the resulting password hash and the information needed to verify it.
- At login: The system uses the submitted password and the stored scheme parameters to calculate a candidate hash.
- To decide: It compares the candidate with the stored verifier. A match indicates the submitted password produced the expected result; the system need not decrypt a stored password.
NIST SP 800-63B describes password-hashing schemes as using a password, salt, and cost factor to produce a password hash. The exact implementation choices and parameter recommendations are outside that description; the key point is that hashing alone does not make password storage safe. Weak, guessable passwords can still be guessed, and a poorly configured scheme can undermine protection. See NIST SP 800-63B.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can a hash be decrypted?
No: decryption is the operation that reverses encryption, not hashing. A hash is designed to be one-way, so the intended approach is not to recover the input from the digest. However, a person may guess a likely input, hash that guess, and see whether it matches. That is why “one-way” should not be read as “impossible to guess” or “safe for any input.”
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
