Password Hashing

Updated 31 Jul 2026

•
def
- •
  the practice of storing passwords as hash digests rather than in encrypted (reversible) form
•
why hashing instead of encryption
- •
  encrypting passwords requires storing a decryption key somewhere on the system; if an attacker compromises the system, they can find that key and decrypt everyone's password
- •
  hashing avoids this — the system only ever stores the resulting digest, never the original password, so there is no key to steal that would reveal the password itself
•
how login works
- •
  the system salts and hashes the password a user types in, then compares the result to the stored digest
- •
  if the digests match, the login is correct — the system never actually knows what the password is, only whether the two digests match
•
example (Linux)
- •
  on Linux, passwords are not stored in /etc/passwd (that file just has an x placeholder); the actual salted hash digest is stored in /etc/shadow, which only privileged/root users can read
- •
  a /etc/shadow entry like $y$... records which hashing algorithm was used (y = SHA-512), followed by the salt and the resulting hash value
•
related
- •
  Hashing
- •
  Salting
- •
  SHA-512
•
cards
- •
  Why do systems hash passwords instead of encrypting them?
  - •
    Encryption requires storing a decryption key somewhere on the system — if compromised, an attacker gets everyone's password; hashing mean there's no key to steal, only a digest

Linked references 7