Encryption and Hashing Complete Guide with Easy Examples
Encryption and hashing are two fundamental concepts in cybersecurity. Both are used to protect information, but they solve different security problems. Encryption is designed to keep data confidential and recoverable, while hashing is primarily used to create a one-way representation of data for integrity checks, password storage, and other security applications.
Understanding the difference between encryption and hashing is essential for anyone learning cybersecurity, programming, networking, or web development.
Table of Contents
What Is Encryption?
Encryption is the process of converting readable data, called plaintext, into an unreadable format called ciphertext using an encryption algorithm and a key.
The basic process is:
Plaintext → Encryption + Key → Ciphertext
The ciphertext can later be converted back into the original plaintext using the appropriate decryption key.
Ciphertext → Decryption + Key → Plaintext
Example
Suppose you want to send:
Meet me at 8 PM
After encryption, it might look like:
X7kP9#vL2@qT…
A person who intercepts the encrypted message cannot normally understand it without the required key.
Example of Encryption
Imagine you use online banking.
You log in and send your bank:
Account: 123456789
Transfer: $500
Your browser communicates with the bank over an encrypted connection, typically using HTTPS/TLS.
Instead of sending sensitive information as ordinary readable data, TLS establishes cryptographic protection for the connection.
An attacker monitoring the network may see encrypted traffic rather than simply seeing:
“Transfer $500”
This is one reason you should look for HTTPS and the padlock/security indicator when using websites that handle sensitive information.
Where Encryption Is Used
Encryption is commonly used for:
- HTTPS websites
- Online banking
- Messaging applications
- VPN connections
- Wi-Fi security
- Encrypted files
- Full-disk encryption
- Cloud storage
- Secure email
- Database encryption
Types of Encryption
There are two major categories of encryption.
1. Symmetric Encryption
Symmetric encryption uses the same secret key for encryption and decryption.
Same Secret Key
↓
Plaintext → Encryption → Ciphertext
↓
Decryption
↓
Plaintext
For example, if Alice encrypts a file using a secret key, Bob needs the corresponding secret key to decrypt it.
Common Symmetric Algorithms
- AES
- ChaCha20
- 3DES — legacy/deprecated for many applications
AES (Advanced Encryption Standard) is widely used today.
Example
Think of a locked safe.
You put a document inside and lock it with a key. The person receiving the safe needs the correct key to open it.
The key represents the secret cryptographic key.
2. Asymmetric Encryption
Asymmetric cryptography uses a key pair:
- Public key
- Private key
The public key can generally be shared, while the private key must be kept secret.
A simplified model is:
Public Key → Encrypt
Private Key → Decrypt
This concept is used in many systems involving secure communication and digital signatures.
Common Algorithms
Examples include:
- RSA
- ECC
- Ed25519
- ECDSA
Modern systems often use elliptic-curve cryptography because it can provide strong security with relatively small keys.
What Is Hashing?
Hashing is the process of converting data into a fixed-length value called a hash or digest.
Unlike normal encryption, a secure cryptographic hash is designed to be one-way.
Original Data
↓
Hash Function
↓
Fixed-Length Hash
For example:
Hello World
↓
SHA-256
↓
A cryptographic hash value
The important point is that you should not think of hashing as “encryption that can be decrypted.”
A properly designed cryptographic hash function does not provide a normal decryption operation.
Example of Hashing: Passwords
Suppose you create an account on a website.
You enter:
MyPassword123
A secure website should not store the plaintext password directly in its database.
Instead, password-storage software uses a password-hashing algorithm such as:
- Argon2id
- bcrypt
- scrypt
- PBKDF2
The database stores a password hash and the parameters/salt needed for verification.
When you log in later:
Password entered
↓
Password hashing
↓
Compare with stored password hash
↓
Match?
↙ ↘
Yes No
Login Reject
The website can verify that you supplied the correct password without needing to store the original plaintext password.
Why Hashing Is Useful
Hashing is particularly useful for:
1. Password Storage
Passwords should be stored using dedicated password-hashing functions such as Argon2id, bcrypt, scrypt, or PBKDF2, rather than ordinary fast hashes such as SHA-256.
2. File Integrity
Suppose you download a 5 GB Linux ISO.
The publisher provides a SHA-256 checksum.
You calculate the hash of your downloaded file:
Downloaded File
↓
SHA-256
↓
Your Hash
If your hash matches the publisher’s expected hash, it provides evidence that the file contents match.
3. Digital Signatures
Hash functions are also commonly used as part of digital-signature systems. Instead of signing an entire large document directly, a cryptographic digest can be incorporated into the signature process.
Encryption vs Hashing
The most important difference is reversibility.
| Feature | Encryption | Hashing |
| Main purpose | Confidentiality | Integrity / verification |
| Reversible? | Yes, with the correct key | No normal reversal |
| Uses a key? | Yes | Cryptographic hashes generally don’t |
| Output | Ciphertext | Hash/digest |
| Original data recovered? | Yes | No |
| Common uses | HTTPS, files, messaging | Password verification, checksums |
| Examples | AES, RSA, ChaCha20 | SHA-256, SHA-3 |
Encryption and Hashing in a Website
Consider an online shopping website.
When you create an account:
Password
↓
Argon2id / bcrypt
↓
Password hash
↓
Database
When you pay for an order, sensitive communication between your browser and the website is protected using TLS encryption.
So the same website may use both technologies, but for different purposes.
Simplified Architecture
ONLINE STORE
│
┌──────────────┴──────────────┐
│ │
User Password Web Connection
│ │
Password Hash TLS
│ │
Database Encrypted Traffic
A Simple Everyday Analogy
Imagine you own a secure office.
Encryption = Locked Box
You place a document inside a locked box.
The authorized person has the key and can open the box and read the document.
Purpose: Keep the document secret.
Hashing = Fingerprint
Instead of giving someone the document, you create a unique fingerprint representing its contents.
If the document changes, its fingerprint should change.
Purpose: Verify the data rather than recover it.
Important: Hashing Is Not the Same as Encoding
Beginners often confuse encryption, hashing, and encoding.
They are different.
Encoding
Encoding changes data into another representation so that systems can store or transmit it conveniently.
Example:
Text → Base64 → Encoded Text
Base64 is not encryption and provides no confidentiality.
Encryption
Plaintext → Encryption → Ciphertext
It is intended to provide confidentiality and can be decrypted with the appropriate key.
Hashing
Data → Hash Function → Digest
It is intended to provide a one-way digest for purposes such as verification.
Why You Should Not Store Passwords Using SHA-256 Alone
A common beginner mistake is:
$password_hash = hash(‘sha256’, $password);
Although SHA-256 is a secure cryptographic hash function for many applications, it is too fast for password storage.
Attackers can test huge numbers of password guesses against fast hashes.
For password storage, use PHP’s built-in password hashing API:
$hash = password_hash($password, PASSWORD_DEFAULT);
Then verify it with:
if (password_verify($password, $hash)) {
echo “Login successful”;
}
PHP’s password API handles appropriate password-hashing parameters and salts for you.
What Is a Salt?
A salt is a unique random value incorporated into password hashing.
Consider two users who both choose:
password123
Without proper salting, identical passwords could produce identical stored hashes.
With unique salts:
password123 + Salt A → Hash A
password123 + Salt B → Hash B
Therefore, identical passwords do not necessarily have identical stored password hashes.
Modern password-hashing functions such as password_hash() generate and manage salts as part of the password hash representation.
Key Security Concepts
Good cryptographic systems aim to provide several important properties.
Encryption
Primarily provides:
Confidentiality
Only authorized parties should be able to access protected information.
Hashing
Can provide:
Integrity
A change in the input should produce a different digest.
Cryptographic hashes are also designed to have properties such as:
- Preimage resistance
- Second-preimage resistance
- Collision resistance
- Avalanche effect
Common Algorithms
Encryption
| Algorithm | Type | Typical Use |
| AES | Symmetric | Data encryption |
| ChaCha20 | Symmetric | Secure communications |
| RSA | Asymmetric | Encryption/signatures, legacy and specialized uses |
| ECC | Asymmetric family | Modern public-key cryptography |
Hashing
| Algorithm | Typical Use |
| SHA-256 | File integrity, cryptographic applications |
| SHA-3 | Cryptographic hashing |
| BLAKE2/BLAKE3 | Fast hashing and integrity applications |
| Argon2id | Password hashing |
| bcrypt | Password hashing |
| scrypt | Password hashing |
MD5 and SHA-1 should not be used for new security-sensitive cryptographic applications where collision resistance is required.
Encryption + Hashing: The Big Picture
A modern application can use several cryptographic mechanisms simultaneously.
For example:
USER
│
▼
HTTPS / TLS
│
▼
Web Application
│ │
│ │
▼ ▼
Password Sensitive Data
│ │
▼ ▼
Argon2id Encryption
│ │
▼ ▼
Database Protected Data
Each mechanism has a different job.
Conclusion
Encryption and hashing are not interchangeable.
Encryption transforms plaintext into ciphertext so that authorized users can recover the original information with the appropriate cryptographic key.
Hashing transforms data into a cryptographic digest designed for one-way verification. It is particularly important for password storage and data-integrity applications.
The easiest way to remember the difference is:
Encryption protects data so it can be recovered.
Hashing creates a one-way representation so data can be verified.
Understanding this distinction is a fundamental step toward learning web security, ethical hacking, application security, and cybersecurity.
