How Does Password Hashing Work?

Hashing Is a One-Way Scrambler

Think of a hash like a fingerprint. When you sign up on a website, your password gets processed through a special math formula called a hash function. Out comes a long string of mixed-up letters and numbers — the hash. If someone later steals that hash, they can't reverse it back into your real password.

The trick is that hashing is one-way. You can put "cats123" in and get a hash out. But you can never take that hash and figure out the original password. It's like blending a smoothie — you can never get the original orange back.

Even better, the same password always makes the same hash. So when you log in tomorrow, the website hashes what you type — and if it matches the hash they stored, you're in.

Why This Keeps Your Password Safe

If a hacker breaks into a website's database, they find a list of usernames and hashed passwords. Without hashing, they'd have every person's actual password — and most people reuse passwords across sites. A hacker could try those same logins on bank sites, email accounts, everything.

Hashing changes this. Even with a stolen database, a hacker just sees scrambled gibberish they can't use. They would need to guess passwords and hash them one by one to find matches — a slow, expensive process.

The Hashing Process, Step by Step

Here's what actually happens when you create an account on a well-built website:

1. You type in a password like "hunter2".
2. The website runs it through a hash function — a math machine that scrambles it into something like "a8b3f2c1...".
3. The website saves that hash in its database. It does not save your actual password.
4. When you log in, it hashes what you type and compares it to the stored hash.
5. If they match — you're in. If not, login fails.

The magic property: given just the hash, there's no way to figure out what you typed. Hackers can't reverse-engineer it.

Hashing with bcrypt in JavaScript

Here's how a modern hashing library handles password storage and verification. bcrypt is a popular algorithm designed to be slow — which sounds bad, but it actually makes it much harder for hackers to crack:

// In a real app, run: npm install bcrypt
const bcrypt = require('bcrypt');

// --- Step 1: Hashing a new password ---
async function registerUser(plainPassword) {
  // genSalt adds random data so identical passwords
  // produce different hashes (extra security!)
  const salt = await bcrypt.genSalt(10);
  const hashedPassword = await bcrypt.hash(plainPassword, salt);
  // Save hashedPassword to your database
  saveToDatabase({ password: hashedPassword });
  console.log("Hash saved: $2b$10$KljuQW...ePxI2Gq");
}

// --- Step 2: Checking a login ---
async function loginUser(plainPassword, storedHash) {
  const match = await bcrypt.compare(plainPassword, storedHash);
  if (match) {
    console.log("Access granted!");
  } else {
    console.log("Wrong password.");
  }
}

// --- Demo ---
registerUser("hunter2");
loginUser("hunter2", "$2b$10$KljuQW...");  // Access granted!
loginUser("wrongpass", "$2b$10$KljuQW..."); // Wrong password.

Knowledge Check

Test what you learned with this quick quiz.