mediumConceptEntryMidSenior
Why do we hash passwords instead of encrypting them, and what makes a password hash different from SHA-256?
Password hashing vs encryption comes down to reversibility: encrypted passwords can be recovered with a key, while hashes are verified one way. Password storage needs salts and slow memory-hard algorithms such as Argon2, bcrypt or scrypt, not fast SHA-256.
5 min readUpdated 2026-08-15
Answer
Short answer
Passwords are hashed because login only needs verification, not recovery of the original password. Use a unique salt and a deliberately slow password-hashing algorithm; do not use reversible encryption or a fast general-purpose hash such as SHA-256.
Was this answer helpful?
Likely follow-ups
- What is a pepper, where does it live, and what does it protect against that a salt does not?
- How do you pick a work factor, and what do you do about it three years later?
- Your login endpoint responds faster for unknown usernames than for wrong passwords. Why does that matter?
- How would you migrate a database of MD5 password hashes without forcing every user to reset?
Related questions
- Would you use server-side sessions or JWTs for authenticating your API, and why?hardAlso on authentication5 min
- A flex item with a long URL in it pushes past its container instead of shrinking. Why does flex-shrink not save you?mediumSame kind of round: concept4 min
- A third-party script in the head delays your first paint by a second. What do async, defer and type="module" each change about parsing and execution order?mediumSame kind of round: concept5 min
- You need a random number from 1 to 6 and you wrote rand() % 6. What is wrong with that, and when does it stop being merely wrong and become a vulnerability?mediumSame kind of round: concept4 min