Short answer
Encryption is two-way: with the right key, encrypted data can be turned back into the original. Hashing is one-way: a hash cannot be turned back into the password. That is why security standards say websites and business systems should store passwords as salted hashes made with a slow, purpose-built algorithm, not as encrypted text. An "encryption password" is different: it is a password you choose to lock a file or device, and it is turned into an encryption key.
Hashing vs encryption
The OWASP Password Storage Cheat Sheet, a widely used reference for developers, puts it plainly: in almost all circumstances, passwords should be securely hashed using modern, adaptive hashing algorithms such as Argon2id, bcrypt or PBKDF2, rather than encrypted or stored in plaintext (OWASP: Password Storage Cheat Sheet).
- Hashing is a one-way function. It is impossible to "decrypt" a hash and get the original password back. When you log in, the system hashes what you typed and compares the result with the stored hash.
- Encryption is a two-way function. Anyone who gets the key can recover the original text. That suits data that must be read again, such as a customer address, but it means a stolen key exposes every encrypted password at once.
OWASP says encryption should only be used for passwords in edge cases where a system must recover the original password, for example to sign in to an older system that does not support a modern way to grant access, and that a different design should be used wherever possible.
Salts, peppers and slow algorithms
The U.S. National Institute of Standards and Technology (NIST) Digital Identity Guidelines require that passwords be stored in a form that resists offline attacks: salted and hashed using a suitable password hashing scheme, with the salt and the resulting hash stored for each password (NIST SP 800-63B). Here is what those terms mean:
- A salt is a random value added to each password before it is hashed. Two people with the same password end up with different hashes, so an attacker cannot crack many accounts at once with a precomputed list.
- A pepper is a secret value shared across all stored passwords. Unlike a salt, OWASP says it should not be stored with the hashes. NIST likewise requires that any secret key be stored separately from the hashed passwords.
- A slow, adaptive algorithm makes each guess expensive. OWASP recommends Argon2id first, scrypt if Argon2id is not available, bcrypt for legacy systems, and PBKDF2 with at least 600,000 iterations where FIPS-140 compliance is required.
What is an encryption password?
When you protect a file, laptop or backup with a password, the password is used to unlock encryption on that data. It is not stored as a hash for a login check; it is turned into the key that scrambles the data. That has an important consequence: if you forget it, nobody can simply reset it.
For example, Word lets you encrypt a document under File, Info, Protect Document, Encrypt with Password, and Microsoft warns that if you lose or forget the document password, Word won't be able to recover it for you (Microsoft: Protect a Word document with a password). For business files, store encryption passwords and recovery keys somewhere your organization controls, not only in one person's head.
What this means for your business
You probably do not write the software that stores your staff and customer passwords, but you choose it. A few practical steps:
- Ask vendors of any system that keeps its own logins (a customer portal, booking system or line-of-business app) how passwords are stored. "Salted and hashed with Argon2id, scrypt, bcrypt or PBKDF2" is the answer you want. "Encrypted" or "we can email you your password" is a warning sign.
- Use single sign-on with your Microsoft 365 accounts where the software supports it, so there are fewer separate password stores to protect.
- Turn on multi-factor authentication. A stolen or cracked password alone is then not enough to sign in. Read MFA beyond text messages.
- Follow the Canadian Centre for Cyber Security's length guidance: passwords of at least 12 characters, or passphrases of at least 4 words and 15 characters (Cyber Centre: Best practices for passphrases and passwords).
- Use a password manager protected by a strong password and multi-factor authentication. The Cyber Centre suggests using it for lower-sensitivity accounts, not for sensitive accounts such as those with administrative privileges or banking credentials.
How shawcsIT helps
Our cybersecurity services include password management, multi-factor authentication, security awareness training and vulnerability assessments for Ontario businesses. We can review which of your systems keep their own passwords and help you move them behind Microsoft 365 sign-in and MFA. Call 705-742-2204 or schedule a free consultation.
FAQ
Are passwords encrypted or hashed?
They should be hashed. OWASP and NIST both call for passwords to be salted and hashed with a suitable password hashing scheme. Encryption is reversible with the key, so it is only appropriate in rare cases where a system must recover the original password.
Can a password hash be decrypted?
No. Hashing is one-way, so there is nothing to decrypt. Attackers who steal hashes instead guess passwords, hash each guess and look for a match. Salts and slow algorithms make that guessing far more expensive, and long passphrases make it impractical.
What is an encryption password?
It is a password that unlocks encrypted data, such as a password-protected document or an encrypted drive. The password is used to derive the encryption key, so if it is lost the data usually cannot be recovered.
Is SHA-256 good enough for storing passwords?
Not on its own. OWASP recommends purpose-built password hashing algorithms (Argon2id, scrypt, bcrypt, or PBKDF2 with a high iteration count, such as PBKDF2 with HMAC-SHA-256 and at least 600,000 iterations) because they are deliberately slow and resist guessing.
Sources
- Password Storage Cheat Sheet (OWASP Cheat Sheet Series)
- SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management (NIST)
- Best practices for passphrases and passwords (ITSAP.30.032) (Canadian Centre for Cyber Security)
- Protect a Word document with a password (Microsoft Support)