Passwords & Hashing
Why Passwords Need Hashing, Not Encryption
Learn why authentication systems should verify password hashes without storing recoverable passwords.
In brief
What it is: Passwords are normally stored with one-way password hashing because the system never needs to recover the original value.
Why it matters: That design limits harm if the password store is exposed and aligns the verifier with the job it actually performs.
Worth knowing: One-way password hashing supports verification while keeping the original password unrecoverable.
A password field is one of the clearest places where reversible encryption is the wrong mental model. The system should not need to recover the original password. It only needs to verify whether the submitted password matches the stored verifier.
That is why secure password storage normally relies on dedicated password hashing, not reversible encryption. If your system can decrypt everyone’s password, a compromise becomes far more damaging.
Why hashing is the right fit
- Hashing supports verification without storing a recoverable secret.
- Reversible encryption creates key-management risk: if the key is exposed, every stored password may be exposed with it.
- Dedicated password hashes such as bcrypt are designed to slow attackers down.
- Encryption still has a place for secrets that must be recovered later, but user passwords are not that kind of secret.
Where the site tools fit
- Use Bcrypt Generator to understand the shape of a password hash and Verify Bcrypt to model the verification step.
- Use Protect Text only when you truly need reversible protection for recoverable secrets, not user passwords.
- When documenting your own product, use the phrase “store password hashes” rather than “encrypt passwords.”
Mistakes that waste time
- Encrypting passwords because it feels stronger than hashing.
- Storing plaintext and planning to “fix it later.”
- Using a fast general-purpose hash without a dedicated password-hashing design.
- Confusing secret storage requirements with password verification requirements.
Questions worth answering
Why is recoverability a problem?
Because authentication systems do not need it. Recoverable passwords increase impact if the application or key material is compromised.
Can I ever encrypt a password?
You may encrypt it while transporting it or handling it transiently in a secure protocol, but the stored verifier should normally be a password hash.
What should users do if they forget a password?
Use a reset flow that creates a new password hash while the original password remains unrecoverable.
Reproduce it with exact bytes
- Freeze the exact input bytes, including encoding and newline handling.
- Generate or verify the digest with a small known sample.
- Record the algorithm, comparison rule, and storage format where future maintainers can find it.
1. exact input bytes
2. hash or HMAC operation
3. constant-format comparison
4. document algorithm and encoding
