<strong>Password hashing</strong> is the process of converting passwords into irreversible scrambled strings before storing them. Even if your database is stolen, attackers can't read the original passwords.
The Meat Grinder Analogy
Hashing is like grinding meat—you can turn steak into ground beef, but you can't turn ground beef back into steak. Same with passwords: you can hash them but can't unhash them.
Password (Meat)
Original form
Hash Function (Grinder)
One-way process
Hash (Ground Meat)
Can't reverse
User Input
bcrypt/Argon2
Stored in DB
User creates password
password123 (never store this!)
Hash with salt
bcrypt.hash('password123', 10)
Store hash in database
$2b$10$N9qo8uLOickgx2ZMRZoMye...
User logs in
They enter password123 again
Compare hashes
bcrypt.compare(input, storedHash) → true/false
Wrong
"Encryption and hashing are the same"
Correct
<strong>Encryption is reversible, hashing is not</strong>. Encryption: lock with key (can unlock). Hashing: one-way transformation (can't reverse). Always hash passwords, never encrypt.
Why hashing matters:
Database gets hacked and leaked
Attackers see: $2b$10$N9qo8uLOickgx2ZMRZoMye...
Can't reverse the hash to get original password
Users' passwords remain safe (if strong hash like bcrypt)