What is hashing?
Hashing converts data of any size into a fixed-length fingerprint using a one-way function. You cannot reverse a hash back into the original input. Sites store password hashes rather than passwords so that a database leak does not immediately hand over everyone's credentials, provided the hashing was done properly.
- Topic
- Cryptography
- Also called
- password hashing, cryptographic hash
- Reading time
- 1 min
- Reviewed
On this page
Hashing is not encryption
Encryption is reversible with the right key; hashing is not reversible at all. If a service can email you your existing password, it is storing it encrypted or in plaintext rather than hashed. Treat that as a warning.
Fast hashes versus password hashes
SHA-256 and MD5 are designed to be fast, which makes them excellent for file integrity and terrible for passwords: speed is exactly what an attacker wants. Password storage needs a deliberately slow function such as bcrypt, scrypt, Argon2, or PBKDF2 with a high iteration count.
What people often get wrong
"Hashed passwords in a breach are safe."
Only if they were salted and slow-hashed. When an unsalted SHA-1 database of common passwords leaks, attackers can recover a large fraction of it within hours.
Sources
These primary references support the terminology and current security guidance used in this definition.
