Hashing vs Encryption: Key Differences Explained

The Fundamental Distinction

Hashing and encryption both transform data into unreadable output, but they serve completely different purposes:

• Hashing is a one-way transformation. You cannot recover the original data from the hash.
• Encryption is a two-way transformation. You can decrypt the ciphertext back to plaintext with the correct key.

This difference determines when to use each. Use hashing when you never need the original data back. Use encryption when you do.

One-Way vs Two-Way

Hashing: No Way Back

const crypto = require('crypto');

// Hashing — one way
const hash = crypto.createHash('sha256').update('my password').digest('hex');
console.log(hash);
// "a3d2f..." — cannot be reversed to "my password"

Once data is hashed, there is no mathematical operation to derive the input from the output. The only way to "find" the input is brute force — try every possible value until the hash matches.

Encryption: Reversible With a Key

const crypto = require('crypto');

// Encryption — two way
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);

const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
const encrypted = cipher.update('my password', 'utf8', 'hex') + cipher.final('hex');
console.log(encrypted);
// "9f3a1b..." — looks random, but can be reversed

// Decryption — recover the original
const tag = cipher.getAuthTag();
const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
decipher.setAuthTag(tag);
const decrypted = decipher.update(encrypted, 'hex', 'utf8') + decipher.final('utf8');
console.log(decrypted);
// "my password" — original recovered

Encryption converts data into ciphertext only readable by someone holding the decryption key.

Key Differences at a Glance

When to Use Hashing

Password Storage

This is the most critical use case for hashing. When a user creates an account, you hash their password and store the hash. At login, you hash the submitted password and compare hashes.

const argon2 = require('argon2');

// Store password
const hash = await argon2.hash('user_password123');

// Verify login
const isValid = await argon2.verify(hash, 'user_password123'); // true
const isWrong = await argon2.verify(hash, 'wrong_password');   // false

Nobody — not even your database administrators — can read the original passwords. If the database leaks, attackers must crack each hash individually.

Data Integrity

Verify that files, messages, or software downloads have not been altered:

# Compute a file checksum
sha256sum Ubuntu-24.04.iso
# Compare to the published value on the official website

Deduplication

Identify duplicate files or records by comparing hashes instead of full content. Git uses this principle — identical file content produces the same object hash regardless of filename.

When to Use Encryption

Protecting Sensitive Data at Rest

Encrypt data stored in databases, files, or backups so that unauthorized access to the storage medium does not expose the data:

// Encrypt SSN before storing in database
const encryptedSSN = encrypt(ssn, encryptionKey);

// Decrypt when needed for legitimate business operation
const decryptedSSN = decrypt(encryptedSSN, encryptionKey);

Secure Communication

TLS encrypts data in transit between a browser and server. Nobody intercepting the traffic can read the content.

Token Generation

Encrypted tokens carry data that the recipient can later decrypt and read — unlike hashes, which only verify:

// Create an encrypted session token
const token = encrypt(JSON.stringify({ userId: 123, role: 'admin' }), secretKey);

// Later, decrypt and read the payload
const payload = JSON.parse(decrypt(token, secretKey));

Common Misconceptions

❌ "Hashing is just encryption without a key"

False. Hashing is not encryption at all. Encryption is designed for reversibility. Hashing is designed to be irreversible. They solve different problems.

❌ "I can encrypt passwords instead of hashing them"

Dangerous. If you encrypt passwords, anyone with the decryption key can read every password. If that key leaks, all passwords are exposed simultaneously. With hashing, there is no key — no single point of failure.

❌ "SHA-256 is secure enough for passwords"

Misleading. SHA-256 is a secure hash function, but it is too fast for password hashing. Modern GPUs compute billions of SHA-256 hashes per second, making brute-force attacks practical. Use slow, memory-hard functions like Argon2id or bcrypt for passwords.

❌ "I should hash data I need to read later"

Impossible. Hashing destroys the original data. If you need to retrieve the original value later, you must use encryption — not hashing.

Why You Should Never Store Passwords with Encryption

This deserves special emphasis because the mistake is still common.

The Encryption Problem

// WRONG: Encrypt passwords
const encrypted = encryptPassword('user_password', masterKey);
// Store encrypted in database

// If masterKey leaks → EVERY password is exposed
const allPasswords = database.rows.map(row => decrypt(row.password, masterKey));
// All 10 million passwords revealed in seconds

When you encrypt passwords, the master key becomes a single point of catastrophic failure. One leaked key exposes every account.

The Hashing Solution

// CORRECT: Hash passwords
const hash = await argon2.hash('user_password');
// Store hash in database

// If database leaks → each password must be cracked individually
// No master key exists. Attackers must brute-force each hash.

With hashing, there is no master key. Each password must be attacked individually. Proper salting ensures identical passwords produce different hashes, preventing bulk attacks.

Choosing the Right Tool

Quick Decision Flowchart

1. Do you need to recover the original data?
   • Yes → Use encryption
   • No → Continue
2. Are you storing passwords?
   • Yes → Use hashing (Argon2id or bcrypt)
   • No → Continue
3. Do you need to verify data integrity?
   • Yes → Use hashing (SHA-256)
   • No → Reevaluate your requirements

Related Guides

• Hashing Algorithms Explained
• SHA-256 Practical Guide
• Base64 vs Encryption

Try It Yourself

See hashing in action with our free Hash Calculator. Compute SHA-1, SHA-256, and SHA-512 hashes for any text instantly — all processing happens in your browser, so your data stays private.

Remember: the hash output gives you no way to recover the original input. That is the whole point.

Try the Hash Calculator →