Hashing vs encryption: what is the difference?
By Uxair Ijaz · 2026-10-22 · 2 min read
Hashing and encryption both turn readable data into something that looks random, so they are easy to confuse. The difference is simple: encryption can be reversed with a key; hashing cannot be reversed at all.
| Hashing | Encryption | |
|---|---|---|
| Reversible? | No, one-way | Yes, with the key |
| Output size | Fixed (e.g. 256 bits) | About the size of the input |
| Needs a key? | No (HMAC adds one) | Yes |
| Typical use | Checksums, passwords, signatures | Keeping data private |
Hashing: a fingerprint
A hash function such as SHA-256 turns any input into a fixed-length fingerprint. Change one letter and the fingerprint changes completely:
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("Hello") = 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
Use hashes to:
- Check file integrity: compare the hash of a download with the one the publisher lists.
- Detect duplicates without comparing whole files.
- Sign data with HMAC, a hash mixed with a secret key.
MD5 and SHA-1 are broken for security purposes; prefer SHA-256 or better. The hash generator computes them all.
Passwords need a slow hash
Plain SHA-256 is far too fast for passwords: a graphics card can try billions of guesses per second. Password hashes are deliberately slow and salted:
- bcrypt: the long-standing default, with a tunable cost factor.
- Argon2id: the modern recommendation, also memory-hard.
- scrypt and PBKDF2: still acceptable when configured well.
A salt is random data stored next to each hash, so two users with the same password get different hashes and precomputed tables are useless. Try the bcrypt tool and the password hasher.
Encryption: a lock
Encryption is for data you need to read again. AES-GCM is the usual choice for symmetric encryption: one key both locks and unlocks, and GCM also detects tampering. Public-key encryption (RSA, elliptic curves) uses a key pair, so anyone can encrypt for you but only you can decrypt.
The encrypt / decrypt tool derives an AES key from a passphrase and encrypts text in your browser.
Which one do I need?
- Storing user passwords → slow password hash (bcrypt or Argon2), never encryption. How to choose and tune one.
- Checking a file has not changed → SHA-256.
- Keeping a message or file private → encryption (AES-GCM). AES modes, IVs and keys explained.
- Proving a message came from you → HMAC or a digital signature.
- Sending binary data as text → neither: that is encoding, like Base64.