Hashing vs. Encryption: What's the Difference?
-
Hashing turns data into a fixed-length fingerprint that can't be reversed. Encryption scrambles data so it can be unlocked again with the right key. Here's how the two differ and how they work together in SSL and code signing.
- Automatic renewals
- Less manual work
-
-
*
Hashing vs. Encryption at a Glance
Hashing Encryption Direction One-way: the original data can't be recovered Two-way: data can be decrypted with the right key Key No key Requires a key Output size Always the same length Depends on the size of the data Main purpose Integrity: proving data hasn't changed Confidentiality: keeping data private Typical use File checks, password storage, digital signatures HTTPS, encrypted files and messages -
*
How Hashing Works
A hash function takes data of any size, from a password to a large file, and produces a short string called a hash or digest. The same input always gives the same hash, but even the smallest change to the input produces a completely different one. Here are the SHA-256 hashes of two almost identical inputs:
GoGetSSL 2e4cebc42275548c3073510bf9a3022956864ff7d5664f3faa3f0d70b992d3e6
GoGetSSL. 9dc9ee2446a51a8f7ba2362f59aaf288d7f3e35ac68ca8c3a2ce720f76b20d67Adding a single dot changed the entire result. This is what makes hashes useful for spotting changes: if a file's hash matches the one its publisher listed, the file hasn't been altered.
A good hash function also makes it practically impossible to find two different inputs with the same hash. When researchers find a way to do that, the algorithm is considered broken.
-
*
Which Hash Algorithms Are Used Today
Algorithm Status MD5, SHA-1 Broken. No longer accepted for SSL certificates or code signing. SHA-256, SHA-384 Current standard (SHA-2 family). Used in SSL certificates, code signing, and file checks. SHA-3 A newer alternative to SHA-2, not a replacement for it. Argon2, bcrypt Designed for password storage. Deliberately slow to make password guessing harder. For more on SHA-256 in SSL certificates, see ECC, RSA, and SHA in SSL Certificates.
Important: A fast hash like SHA-256 isn't enough on its own to store passwords. Attackers can try billions of guesses per second against it. Use a dedicated password hashing algorithm such as Argon2 or bcrypt.
-
*
How Encryption Works
Encryption uses a key to turn readable data (plaintext) into unreadable data (ciphertext). Only someone with the correct key can turn it back. There are two main types:
- Symmetric encryption uses one key to both encrypt and decrypt. It's fast and suits large amounts of data. AES is the most widely used symmetric algorithm. The challenge is sharing the key safely.
- Asymmetric encryption uses a key pair: a public key that anyone can have and a private key that stays with its owner. Data encrypted with the public key can only be decrypted with the private key. RSA and ECC are the best-known examples. It's slower, but it solves the problem of sharing a key.
Most real-world systems combine the two. Asymmetric cryptography is used to agree on a symmetric key securely, and that symmetric key then encrypts the actual data.
-
*
How They Work Together
In HTTPS, the SSL certificate and its key pair let the browser and server agree on a symmetric key, which then encrypts all traffic between them. Hashes are used throughout the connection to confirm that nothing was changed on the way.
In digital signatures, such as code signing, the signing tool first creates a hash of the file. The publisher's private key then signs that hash. When a user runs the file, their system recalculates the hash and checks it against the signature with the public key. If the file had been changed, the hashes wouldn't match.
Tip: A digital signature doesn't hide anything. A signed file can still be read by anyone. The signature only proves who published it and that it hasn't been changed. Keeping data private is the job of encryption.
-
