Is hashing the same as encryption for passwords?

No, and for passwords hashing is the right choice. Encryption is reversible with a key, so anyone who steals both the encrypted passwords and the key gets every password back. A hash cannot be reversed, so the system stores only the hash and compares it at login. Ordinary fast hashes such as SHA-256 are still a poor choice for passwords, because attackers who steal a database can try enormous numbers of guesses per second on graphics cards. Use a function built for passwords, deliberately slow and with a random salt per user: Argon2id, scrypt or bcrypt, as the OWASP password storage guidance recommends. If a supplier or an old application stores passwords encrypted, or hashed with plain MD5 or SHA-1, treat it as a finding to fix. For your own staff, the bigger gains are elsewhere: multi-factor authentication (MFA), a password manager and blocking reused passwords. A network sensor does not see how a server stores passwords; that check belongs in an application review.

← All 40 questions on Encryption and encrypted trafficAll topics