Cybersecurity
Encryption vs Hashing: The Difference
Encryption and hashing are often confused, because both scramble data — but they do opposite jobs. Encryption is two-way: it can be reversed with a key. Hashing is one-way: it cannot be reversed at all. That difference is why your passwords are hashed, your messages are encrypted, and a single changed letter produces a completely different hash. This guide explains both, side by side.
Try the tools: Encryption Learning Lab · SHA-256 Hash Generator · SHA-512 Hash Generator · MD5 Educational Demonstrator · Base64 Encoder · Base64 Decoder · URL Encoder · URL Decoder · Caesar Cipher Simulator · ROT13 Encoder / Decoder · Hashing Algorithm Explorer · Text Encryption Demonstrator · Text Decryption Demonstrator
Note. The quick test: if the original data needs to come back, use encryption. If you only need to check that data matches, use hashing. Passwords are the classic case — a service never needs your password back, only needs to check that the one you typed matches the one you set.
Encryption: two-way by design
Encryption turns readable data into scrambled data that can be turned back with a key. You encrypt a message to send it safely; the recipient decrypts it with the key and reads the original. The scrambled output is as long as the input, roughly speaking, and the process is designed to be fully reversible — that is the point.
Encryption protects confidentiality: it keeps data private while it travels or while it is stored, with the promise that the rightful owner can always get it back. The security depends entirely on the key. Lose the key and the data is lost; let the key leak and the data is exposed; choose a weak key and the encryption is weak. The algorithm is public and standardised — the key is the secret.
Hashing: one-way by design
Hashing turns data of any size into a fixed-length fingerprint, called a hash or a digest. The same input always produces the same hash, and a tiny change in the input — one letter, one space — produces a completely different hash. But the process cannot be reversed: given only a hash, you cannot reconstruct the input. That is not a limitation; it is the entire purpose.
The two properties that make hashing useful are determinism and the avalanche effect. Determinism means the same input always gives the same output, so a hash can be used to check whether data matches. The avalanche effect means the output changes dramatically with any change in the input, so a hash can be used to detect tampering — even a single altered character stands out.
Common hash functions include SHA-256, which produces a 256-bit fingerprint, and SHA-512. You meet hashing constantly: it verifies downloaded files, it fingerprints passwords, and it is the building block of the k-anonymity password check explained in our guide on checking whether your password was leaked.
The difference, side by side
Purpose: encryption protects data so the owner can recover it; hashing verifies data without needing to recover it. Reversibility: encryption is reversible with a key; hashing is not reversible by design. Output size: encryption output is roughly the size of the input; hashing output is always the same fixed size, whatever the input. Keys: encryption needs a secret key, and its security depends on that key; hashing needs no key, and its security depends on the function being hard to reverse and hard to collide.
A useful rule: if you need the original back, encrypt. If you only need to check, hash. Messages, files and card numbers are encrypted because someone needs to read them. Passwords are hashed because no one needs to read them — the service only needs to check that the password you typed produces the same hash as the one stored when you set it.
- Encryption: two-way, needs a key, output about the size of the input.
- Hashing: one-way, needs no key, output always a fixed length.
- Encryption protects so data can be recovered. Hashing verifies without recovery.
- Same input, same hash — change one letter, the hash changes completely.
Why passwords are hashed, not encrypted
When you set a password, a good service does not store the password, and does not store an encrypted copy of it either. It stores a hash of the password — and ideally, hashes it with a slow, specially designed function such as bcrypt, scrypt or Argon2, plus a random salt, a random value mixed in so that identical passwords produce different hashes.
When you sign in, the service hashes the password you typed, using the same method and salt, and compares the result with the stored hash. If they match, you are in. The service never sees your actual password in storage, and if its database is stolen, the attacker gets hashes, not passwords — and reversing a properly salted, slowly computed hash is expensive and slow.
This is why breaches are still dangerous even when passwords were hashed: if the service used a fast or unsalted hash, attackers can guess common passwords quickly by hashing their guesses and comparing. The strength of password hashing is in the details — slow functions, unique salts, and strong passwords — which is why unique, long passwords matter even when a service does its job properly.
When each is used
Encryption is used wherever data must be read later: messaging, web browsing, file storage, cloud backups, payment data, and anything that needs to be decrypted by its owner. It is the tool of confidentiality for data in transit and data at rest.
Hashing is used wherever data must be verified but not recovered: password storage, file-integrity checks, digital signatures, and the data structures that hold blockchains together. It is also used inside encryption systems themselves — for example, to verify that a downloaded file is the genuine one, or to derive encryption keys from a passphrase.
They are often used together. A password manager, for example, hashes your master password to check it, then uses it to derive the encryption key that unlocks your vault. A signed document is hashed, and the hash is encrypted with the signer's private key. Knowing the difference matters because it tells you what to expect: an encrypted backup can be restored; a hashed password cannot be recovered, only reset.
Common confusions, cleared up
Hashing is not encryption, and calling a password encrypted when it is hashed — or the other way round — is a real mistake, because the two have different guarantees. An encrypted password can be decrypted by anyone with the key; a hashed password cannot be reversed at all. A service that encrypts passwords is trusting its own key management; a service that hashes them is trusting mathematics.
Encoding is neither. Base64 and similar encodings change the representation of data, not its security — anyone can decode them. If a guide tells you a password was encoded, that is not protection; it is just a different format. Encryption protects, hashing verifies, encoding reformats.
Finally, a hash is not a fingerprint of a person — it is a fingerprint of data. Two identical files have the same hash; two different files almost certainly do not. That is what makes hashing the right tool for detecting change, and the wrong tool for keeping a secret that must be read again.
Sources
- NIST — Cryptographic standards — last checked 14 November 2026.
- National Cyber Security Centre (UK) — Encryption guidance — last checked 14 November 2026.
- CISA — Cybersecurity best practices — last checked 14 November 2026.
Last checked: 14 November 2026.
Frequently asked questions
What is the main difference between encryption and hashing?
Encryption is two-way: data can be decrypted with a key. Hashing is one-way: a hash cannot be reversed to recover the original data. Encryption protects data that must be read again; hashing verifies data without recovering it.
Why are passwords hashed instead of encrypted?
A service never needs your actual password back — it only needs to check that the password you typed matches the one you set. Hashing lets it do that without storing anything reversible, so a stolen database yields hashes, not passwords.
What is a salt in password hashing?
A salt is a random value mixed in before hashing, so that identical passwords produce different hashes. It stops attackers from using precomputed tables of hashes and makes each password need to be attacked individually.
Is hashing the same as encoding?
No. Encoding, such as Base64, only changes the format of data and is easily reversed by anyone. Hashing is a one-way function that cannot be reversed, and encryption is a two-way function that needs a key.
What is the avalanche effect?
The avalanche effect is the property of a good hash function where changing even one character of the input produces a completely different hash. It is what makes hashing useful for detecting tampering.