# Is hashing the same as encryption for passwords?

No, and for passwords hashing is the right choice. Encryption is reversible with a key, so anyone who steals both the encrypted passwords and the key gets every password back. A hash cannot be reversed, so the system stores only the hash and compares it at login. Ordinary fast hashes such as SHA-256 are still a poor choice for passwords, because attackers who steal a database can try enormous numbers of guesses per second on graphics cards. Use a function built for passwords, deliberately slow and with a random salt per user: Argon2id, scrypt or bcrypt, as the OWASP password storage guidance recommends. If a supplier or an old application stores passwords encrypted, or hashed with plain MD5 or SHA-1, treat it as a finding to fix. For your own staff, the bigger gains are elsewhere: multi-factor authentication (MFA), a password manager and blocking reused passwords. A network sensor does not see how a server stores passwords; that check belongs in an application review.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/is-hashing-the-same-as-encryption-for-passwords

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is a digital signature?](https://netsenx.com/en/faq/what-is-a-digital-signature)
- [What is a TLS certificate?](https://netsenx.com/en/faq/what-is-a-tls-certificate)
- [What happens when a TLS certificate expires?](https://netsenx.com/en/faq/what-happens-when-a-tls-certificate-expires)
- [Why are TLS certificate lifetimes getting shorter?](https://netsenx.com/en/faq/why-are-tls-certificate-lifetimes-getting-shorter)
- [Are self-signed certificates on internal servers a problem?](https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem)