People mix these two words more than any other pair in security. The distinction is small and powerful: hashing is one-way, encryption is reversible.
Hashing — the one-way door
A hash function takes your password and produces a fixed string, like scrambling eggs. There is no practical key that unscrambles it. Websites should store the hash, not your password, so even a leaked database reveals nothing usable directly.
Why it matters
- Hash = a fingerprint; encryption = a suitcase with a keyhole.
- Good systems use both: your password is hashed, your data at rest is encrypted.
- Why the difference matters: an attacker with hashes must guess, while an attacker with an encryption key simply reads.
Encryption — the reversible lock
Key takeaways
- Hashing is one-way; encryption is two-way.
- Passwords are hashed; files are encrypted.
- Reused passwords defeat every protection.
Encryption scrambles data with a key, and the same key (or a partner key) reverses it. Your files, drives and phone backup use it: you keep the key, so you get the data back.
The three-second test
If the system needs the original back (a file, a chat), it is encryption. If nobody should ever recover the original (your password), it is hashing.
What you should do
- Worry about reusing passwords — that is what turns a hashed leak into a live account.
- Turn on device/disk encryption to protect files if a device is lost.
- For technical guidance, follow OWASP password-storage and transport guidance rather than blog posts.