What is a password hash?
Definition
A password hash is a scrambled, one-way version of a password that a website stores instead of the password itself, so the real password isn't kept in readable form.
- Category
- Security
- Also called
- hashed password, salted hash, Password hashing
- Last updated
When you create an account, a well-built website doesn't save your password as typed. It runs the password through a hash function, a one-way calculation that turns it into a long string of characters, and stores that string. When you log in later, the site hashes what you typed and compares the result with the stored hash. If they match, you're in. The site never needs to keep your actual password.
NIST's digital identity guidelines say services should store passwords in a hashed form that can't easily be reversed, and that storing them in plain text is not acceptable. They also call for a salt: a random value added to each password before hashing, stored alongside the result. Because every user gets a different salt, two people with the same password end up with different hashes, and an attacker can't crack them all in one go. NIST's draft guidance describes a password hashing scheme that takes a password, a salt and a cost factor, so that each guess is deliberately expensive for someone who has stolen the hashes.
Why it matters to you
Hashing is what limits the damage when a company is breached. If a database leaks and the passwords were properly hashed and salted, attackers get strings they still have to crack one guess at a time. If the passwords were stored in plain text, or hashed carelessly, they are readable or fall quickly. Weak or common passwords are at risk either way, because attackers try likely passwords first and compare the results to the stolen hashes.
You can't see how a site stores your password. What you control is the password itself: long, unique and not reused.
Hashing vs. encryption
Encryption is designed to be reversed with a key. A password hash is designed not to be reversed at all. That is why attackers have to guess passwords and check them against the hash instead of simply "decrypting" it.
How to protect yourself
- 1
Use a unique password for every account
If one site stores passwords badly and is breached, a unique password keeps the damage to that one account.
- 2
Make passwords long
Long passwords make each guess against a stolen hash take much more work. A password manager can create and store them.
- 3
Change a password after a breach notice
If a site tells you it was breached, change that password and any account where you reused it.
- 4
Turn on two-step verification
Even if a password is cracked from a leaked hash, a second step blocks the login.
- 5
Watch for your data in breaches
Serus monitors breach databases and the dark web and alerts you when your email or passwords show up, so you know what to change. It can't remove data from breaches.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Can a password hash be reversed?
Not directly, because a hash function is one-way. Attackers instead guess passwords, hash each guess and compare it with the stolen hash. Weak and common passwords are found this way.
What is a salt?
A salt is a random value added to a password before hashing, stored with the hash. It makes each user's hash different, even when passwords match, and slows large-scale cracking.
Is a hashed password safe if it leaks?
Safer than plain text, but not risk-free. A strong, unique password is hard to crack from a hash. A short or reused one may not be, so change passwords after a breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.