Hashing

Hashing turns a password or file into a short fixed code that cannot be reversed, so websites can check your password without storing it as written.

Hashing: Hashing is a one-way process that turns any input, such as a password, into a fixed-length scrambled code. The same input always gives the same code, but the code cannot be turned back into the original. Websites use it to check passwords without keeping them in plain form.

When you log in, the site hashes what you typed and compares it with the stored code. If a hacker steals the database, they see only hashes and must guess passwords one by one. Weak or fast hashes, and common passwords, make that guessing much quicker, so a breach can still expose many accounts. If you often forget passwords and a site shows your old one, that is a sign it has not hashed it.

Hashes are also used to check that a file or an app has not been changed. As a user, you cannot see how a site stores your password, so protect yourself with a long unique password. If a site ever emails you your password in plain text, it is not hashing properly, and you should avoid it. A password manager makes unique long passwords easy to live with.

Tips

• Use a long, unique password, because hashing cannot save a very common one.
• Stay away from sites that email your actual password back to you.
• Change a password you suspect leaked, even if the site says it was hashed.

Related terms