FresherTechnicalAuthentication & security
What is the difference between hashing and encryption?
Try answering first
Model answer
Hashing is a one-way function: it turns any input into a fixed-size digest, and you cannot get the input back from the digest. The same input always gives the same output, and a tiny change gives a completely different one. Encryption is two-way: with the right key you turn plaintext into ciphertext and back.
Use each for a different job:
- Hashing to check data without storing it, such as passwords (with a slow salted hash like argon2id), file integrity, or deduplication. The system never needs the original.
- Encryption when you must read the data again, such as a card number for refunds, or data sent over TLS. Use a standard authenticated mode such as AES-256-GCM, and protect the key.
A related tool, HMAC, hashes with a secret key to prove a message came from someone who holds that key, which is how webhook signatures work.
Hashing a password is not "encrypting" it, and encrypting passwords is a mistake because anyone with the key reads them all.
Takeaway: if you never need the value back, hash it; if you do, encrypt it.
Key points
- Hashing is one-way, encryption is reversible with a key
- Passwords are hashed with a slow salted hash
- Encrypt data you must read again
- HMAC adds a secret key to a hash
Likely follow-ups
- Why is SHA-256 a poor choice for storing passwords?
- What is the difference between symmetric and asymmetric encryption?
Common mistakes
- Encrypting passwords so they can be recovered
- Calling base64 encoding a form of encryption