Home / Knowledge hub / Hashing
Knowledge hub
Hashing
A one-way transformation, so a password can be checked but never read back.
What it means
Hashing turns a value into a fixed-length result that nobody can turn back. You store the hash rather than the password. When somebody signs in, you hash what they typed and compare the two results, so the system never holds the original.
Encryption works the other way by design. It exists so that whoever holds the key can read the original back. A hash has no key and no way back, which is the entire reason to use one here.
Why it matters
It sets the cost of a bad day. If your password table walks out and you hashed properly, the attacker faces an expensive problem and you gain time to act. Store passwords as plain text, or hash them with something fast, and the attacker leaves with a working list of credentials. People reuse passwords, so that list opens other doors too.
Speed is the part people miss. MITRE has a weakness for it, CWE-916, hashing with insufficient computational effort. OWASP now puts Argon2id first, with scrypt, PBKDF2 and bcrypt behind it. Every password also needs its own random salt, so two people who choose the same password do not produce the same stored value.
How it shows up
Try the simple test on any service, including your own. If it can email you your existing password, it is not hashing it. A reset link that expires is the behaviour you want to see.
Inside an application, the places to look are wherever you store passwords, recovery tokens and API keys, and which algorithm handles each. Cyberlop does not grade your hashing algorithm or review your crypto code. We test the authentication your application exposes and report what we reached.
Questions people ask
Hashing, answered
Can a hash be reversed?
Not directly. There is no key and no published method that derives the input from the output. What attackers do instead is guess: they hash enormous lists of likely passwords and look for a match.
That is why the algorithm's speed matters so much. A fast hash lets somebody test billions of guesses. A slow one makes the same list take years.
What is the difference between hashing and encryption?
Encryption is a round trip. You hold a key, and anyone with that key gets the original back. Hashing is one way, with no key and no route home.
For passwords you want the one-way version, because your server never needs to know the password. It only needs to know that what somebody typed matches what you stored.
Is MD5 fine if I add a salt?
No. A salt stops precomputed tables and stops two identical passwords sharing a stored value. It does nothing about speed, and speed is what makes MD5 unfit for this job.
Modern hardware chews through MD5 at a rate that makes brute force cheap. Use Argon2id, scrypt, PBKDF2 or bcrypt, all of which are deliberately slow.
Do I still need a salt with bcrypt?
You do, and bcrypt already handles it. It generates a random salt per password and stores it inside the result string, so you get the behaviour without writing it yourself.
The mistake to avoid is a single shared salt across the whole table. That brings back the problem the salt exists to remove.
Why can some sites email me my old password?
Because they did not hash it. To send you the original, the system has to hold the original, either in plain text or under encryption it can reverse.
Treat that as a signal about the rest of the engineering. It is one of the few security judgements a customer can make from outside without any tools.
Related
Terms that sit next to this one
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
Authentication
Proving you are who you say you are. It answers one question only.
Brute force
Trying passwords or codes over and over until one of them works.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Data breach
Information you hold ends up somewhere it should not be.
How does your login hold up?
We do not grade your hashing algorithm. We do test the authentication your application exposes, and we show you exactly what we reached. Ask what a 30 day pilot on one application would cover.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.