Hashing vs Encryption
Encryption preserves a secret so someone with the key can recover it; password hashing is deliberately one-way. A service should verify your password without ever being able to retrieve the original.
A forgotten-password email that contains your old password is not helpful customer service. It is evidence that the company kept your secret in recoverable form—exactly what a decent password system should make impossible.
E1Verification without recovery
Encryption is built for information that must later be read: ciphertext goes in, and the right key brings the original back. That reversibility is useful for messages protected by end-to-end-encryption, but dangerous as the basic storage model for passwords.
Hashing changes the job. When you create a password, the service stores its one-way output. When you log in, it hashes what you typed and compares the result with the stored value. Matching proves that you supplied the same input; there is no corresponding “dehash” operation that returns the password. The crucial design shift is from recovering a secret to testing a claim.
E1Where it shows up
The revealing recovery email
If support can send your original password back, the system has retained something recoverable—plaintext or a reversible equivalent. A proper reset flow replaces the credential instead of revealing it. That warning matters even more when password-reuse lets one exposed password unlock unrelated accounts through credential-stuffing.
E1One-way storage is not complete account security
Hashing fixes the recoverability problem; it does not make a weak or reused password safe everywhere else. attacker-economics still favors the cheapest route, including trying credentials leaked by another service. A password-manager reduces reuse, while two-factor-authentication makes possession of the password less decisive.
Test the reset path
The next time you forget a password, inspect what the service does. If it reveals the old password, stop reusing that credential there, replace it with a unique password generated by your manager, and enable a second factor if available. A legitimate service should let you set a new secret—not prove that it can read the old one.
E1Episodes that teach this
-
How to Not Get Hacked Online? Cybersecurity Attacks Safety - Tips from a Hacker
· explained at 9:09
1,253 views
"It is hashing not encryption... for hashing there is no dehashing" and "no decent company ever saves your plain text password."