# What is Hashing?

> A one-way transformation that turns any input into a fixed-length fingerprint which cannot be reversed.

Last reviewed: 2026-09-01

## Hashing

Category: Cryptography

Also called: password hashing, cryptographic hash

Canonical page: https://moolkey.com/glossary/hashing

Hashing converts data of any size into a fixed-length fingerprint using a one-way function. You cannot reverse a hash back into the original input. Sites store password hashes rather than passwords so that a database leak does not immediately hand over everyone's credentials, provided the hashing was done properly.

### Hashing is not encryption

Encryption is reversible with the right key; hashing is not reversible at all. If a service can email you your existing password, it is storing it encrypted or in plaintext rather than hashed. Treat that as a warning.

### Fast hashes versus password hashes

SHA-256 and MD5 are designed to be fast, which makes them excellent for file integrity and terrible for passwords: speed is exactly what an attacker wants. Password storage needs a deliberately slow function such as bcrypt, scrypt, Argon2, or PBKDF2 with a high iteration count.

### What people often get wrong

Claim: "Hashed passwords in a breach are safe."

Correction: Only if they were salted and slow-hashed. When an unsalted SHA-1 database of common passwords leaks, attackers can recover a large fraction of it within hours.

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.