Hashing vs encryption.
A one-way fingerprint you can never reverse, versus a locked box you can reopen with the right key.
These get confused all the time, but they exist for opposite purposes. Hashing is a one-way blender: it turns data into a fixed-size fingerprint that you can never turn back into the original. There is no "un-hash" — that is the whole point.
Encryption is a two-way locked box: it scrambles data so it is unreadable, but with the right key you can unlock it and get the exact original back. If you ever need to read the data again, you encrypt; if you only ever need to verify or compare it, you hash.
- In goes the password.1
Hashing drops your data into a one-way blender and you can never get it back.
- Always the same size.2
Out comes a fixed-size smoothie — same length whether you fed it a word or a novel.
- Matches the stored one.3
That is the point: to check a password, hash what was typed and compare smoothies.
- Locked, not blended.4
Encryption is different: a locked box that scrambles your data but keeps it whole.
- Click — there it is.5
With the right key you reopen the box and the exact original is sitting inside.
- Need it back? Box it.6
Pick by one question: will you ever need it back? If yes, encrypt. If never, hash.
Pick by whether you need it back
The deciding question is simple: will you ever need to read this data again? Passwords are the classic hashing case — the system never needs your actual password, only to check that what you typed matches, so it stores a one-way hash and a stolen database reveals nothing reversible. A credit card number you must later charge, or a message your recipient must read, has to come back, so it is encrypted with a key that authorised parties hold.
And neither is encoding
A frequent third confusion is encoding (like Base64), which is not security at all — it just reformats data so it travels safely, and anyone can trivially decode it. Encoding offers zero protection. Encryption protects secrecy but depends entirely on keeping the key safe. Hashing protects against reversal but, for things like passwords, needs salt and a deliberately slow algorithm to resist guessing. They solve different problems and are not interchangeable.