What Is a Password Hash

A password hash is the scrambled form of a password that a well-built website actually stores, instead of the password itself — it is produced by a hashing function, a one-way mathematical process that turns any input into a fixed-length jumble of characters that cannot be reversed back into the original, which is the whole point: even the site never keeps your real password. This solves a problem the staying-safe-online topic raised. If a site stored passwords as plain text, then a single breach would instantly hand attackers everyone's actual passwords — and because people reuse passwords, those would unlock their other accounts too. Storing only the hash means a stolen database contains jumbles, not passwords. The trick that makes this usable is that hashing is deterministic: the same input always produces the same hash, so when you log in, the site hashes what you typed and compares it to the stored hash — if they match, your password was right, and the site confirmed it without ever knowing or keeping the password itself. A hash is different from the encryption in the staying-safe-online and VPN topics in one crucial way: encryption is two-way and designed to be reversed with a key, while hashing is deliberately one-way with no key and no way back, which is exactly why it is the right tool for passwords, where you never need to recover the original, only to check a match. Two refinements make real password hashing secure, because naive hashing has weaknesses. The first is salting: a unique random value, the salt, is added to each password before hashing, so that two users with the same password still get completely different hashes — this defeats attackers who precompute the hashes of common passwords in giant lookup tables, since the salt makes every stored hash one-of-a-kind. The second is deliberate slowness: ordinary hash functions are built to be fast, but password-specific algorithms (with names like bcrypt, scrypt, and Argon2) are intentionally made slow and resource-hungry, so that checking one password is trivial for the site but testing billions of guesses becomes painfully expensive for an attacker. This is also why a strong, long password still matters even when hashed: hashing protects the stored form, but if your password is short or common, an attacker who steals the hashes can still grind through guesses until one matches — which is the technical reason the staying-safe-online topic stressed long, unique passwords and a password manager. The simple takeaway is that a password hash is a one-way fingerprint of your password: the site stores the fingerprint, not the password, checks future logins by comparing fingerprints, and uses salting and deliberately slow algorithms so that even a stolen database of hashes is very hard to turn back into real passwords.