iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Hashing turns data into a fixed-length digest that is designed to be checked, not decoded. Encryption turns readable data into ciphertext so an authorized party can recover it by decrypting it. That difference explains why systems can verify a password without storing a recoverable copy of it.
What is hashing?
A cryptographic hash function accepts input data and produces an output of fixed length, called a hash or digest. The input can vary in size; the digest has a fixed size for a given function. NIST defines a hash function as “A function on bit strings in which the length of the output is fixed.” NIST’s glossary also describes approved cryptographic hash functions in terms of one-way and collision-resistant properties.
In practical terms, one-way means it should be computationally infeasible to find an input for a specified digest. Collision resistance means it should be computationally infeasible to find two different inputs that produce the same digest. These are security goals, not claims of mathematical impossibility: if an input is common or easy to guess, someone can try candidate inputs and compare their hashes.
What is encryption?
Encryption transforms plaintext—the original readable data—into ciphertext to conceal its meaning. With reversible encryption, an authorized process uses decryption to restore the original data. NIST defines encryption as a transformation that conceals information. NIST’s encryption glossary covers the term and its relationship to decryption.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Hashing vs. encryption: the key differences
| Aspect | Hashing | Encryption |
|---|---|---|
| Purpose | Produce a compact digest used to represent or check data | Conceal data so it can be recovered by an authorized process |
| Output | A fixed-length digest | Ciphertext |
| Reversibility | Designed to be one-way; there is no ordinary decryption step | Reversible through decryption when the appropriate process and key are available |
| Typical question it answers | “Does this input produce the expected digest?” | “How can an authorized user recover the original data?” |
A hash may be used inside a larger cryptographic construction, but that does not make ordinary hashing encryption. The two techniques solve different problems: checking a representation versus keeping information confidential and recoverable.
Why password systems hash passwords instead of encrypting them
A login system generally needs to decide whether a submitted password matches the one a user set. It does not need to recover and display the original password. Storing a verifier derived through password hashing lets the system compare a fresh login attempt without keeping a recoverable password copy.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
NIST describes password-hashing schemes as using a password, a salt, and a cost factor to produce a password hash. The salt and cost factor are scheme inputs; the stored verifier can be checked by applying the configured scheme to a newly submitted password and comparing the result. See NIST SP 800-63B.
Recommended Free Tools
What the salt and cost factor do
- Salt: A value used with the password by the hashing scheme, so identical passwords need not produce identical stored results.
- Cost factor: A scheme parameter that makes password-hash computation more demanding, increasing the work involved in checking guesses.
Hashing by itself does not guarantee password safety. Guessable passwords can still be guessed, and a poorly configured scheme can weaken protection. The specific implementation and parameter choices matter; the NIST material cited here establishes the role of salt and cost factor but does not, in this context, establish one universal parameter setting for every system.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Can a hash be decrypted?
No—not in the way ciphertext is decrypted. A cryptographic hash is designed as a one-way digest, so there is no normal operation that restores the original input from the hash. However, if the input is predictable, a person can hash likely candidates and see whether one matches. That is guessing, not decrypting, and it is why password strength and a properly configured password-hashing scheme matter.
Quick Recap
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When should data be hashed or encrypted?
- Use hashing when a system needs a digest for checking or comparison rather than a recoverable copy of the input, as in password verification.
- Use encryption when data must remain concealed but later be recovered by an authorized process.
- Do not substitute one for the other: a digest does not provide recoverability, and encryption does not provide the same one-way verification behavior as password hashing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
