Encryption vs Hashing
One is reversible, the other isn't
Encryption and hashing both transform data into unreadable formats, but they serve fundamentally different purposes. Encryption is designed to be reversed with a key, while hashing is a one-way operation that should never be reversible.
Encryption
Encryption is the process of converting plaintext into ciphertext using an algorithm and a key, with the explicit intent that the original data can be recovered by someone who possesses the correct decryption key. There are two main types: symmetric encryption (AES, ChaCha20) where the same key encrypts and decrypts, and asymmetric encryption (RSA, ECC) where a public key encrypts and a separate private key decrypts. Encryption is essential for protecting data in transit (HTTPS, VPNs) and at rest (disk encryption, database encryption). The security of encryption depends on key management — the algorithm can be public, but the key must remain secret.
Hashing
Hashing is a one-way mathematical function that converts input of any size into a fixed-size output (the hash or digest). Unlike encryption, hashing is intentionally irreversible — there is no key that can recover the original data from the hash. Good hash functions like SHA-256 and bcrypt produce completely different outputs for even tiny input changes (the avalanche effect) and make it computationally infeasible to find two inputs that produce the same hash (collision resistance). Hashing is used for password storage, data integrity verification, digital signatures, and data structures like hash tables.
Key Differences
- **Reversibility**: Encryption is two-way (encrypt/decrypt with a key). Hashing is one-way — you cannot recover the original input from the hash. - **Output size**: Encryption output size varies with input size. Hash output is always fixed-length regardless of input (SHA-256 always produces 256 bits). - **Keys**: Encryption requires keys for both encrypting and decrypting. Hashing requires no key (though HMACs add a key for authentication). - **Purpose**: Encryption protects confidentiality — keeping data secret. Hashing verifies integrity — proving data hasn't changed. - **Speed**: General-purpose hashes (SHA-256) are designed to be fast. Password hashes (bcrypt, Argon2) are intentionally slow to thwart brute-force attacks. - **Determinism**: Both are deterministic, but password hashes add a random salt so the same password produces different hashes each time.
When to Use Each
**Use encryption** when you need to store or transmit data that must be readable later: messages, files, database fields containing sensitive PII, API tokens. The data has value in its original form and authorized parties need to access it. **Use hashing** when you need to verify data without storing the original: passwords (store the hash, compare on login), file integrity checks (checksums), commit identifiers in Git, and deduplication. If you never need the original data back, hash it.
Analogy
**Encryption** is like a safe with a combination lock. You put your valuables inside, lock it, and anyone with the combination can open it and retrieve the contents. **Hashing** is like a meat grinder. You put a steak in and get ground beef out. You can verify that the ground beef came from a steak, but you can never reassemble the steak from the ground beef.