Why passwords are stored as hashes

A gym chain’s member database is copied by an attacker. It holds 40,000 email addresses and passwords.

Many members use the same password for their bank. If the passwords are readable, the harm spreads far beyond the gym.

A well-built system never stores the password at all. This lesson shows what it stores instead.

A hash function turns any text into a code of a fixed length. That code is the hash.

The same text always gives the same hash. Change one letter and the hash looks completely different.

You cannot turn a hash back into the text. That is why it is safe to store.

import hashlib


def hash_of(text):
    # encode() turns the text into bytes, which hashlib needs
    return hashlib.sha256(text.encode()).hexdigest()


print(hash_of("summer2026"))
print(hash_of("summer2026"))
print(hash_of("Summer2026"))
print(len(hash_of("a")), len(hash_of("a much longer password")))

# Change one letter of "summer2026" and run it again.

When you sign up, the system hashes your password and stores only the hash.

When you log in, it hashes what you typed. Then it compares the new hash with the stored one. If they match, you are in.

The system never needs to know your password. An attacker who steals the table only gets hashes.

Two people with the same password get the same hash. An attacker can spot that. They can also look up common hashes in a big list made in advance.

A salt fixes this. The system adds random text to each password before hashing it. The salt is stored beside the hash. It does not need to be secret.

import hashlib


def hash_of(text):
    return hashlib.sha256(text.encode()).hexdigest()


# Two staff members picked the same password
print("Amir:", hash_of("summer2026")[:16])
print("Beth:", hash_of("summer2026")[:16])

# Now each gets their own salt, stored beside the hash
print("Amir:", hash_of("x7Q2" + "summer2026")[:16])
print("Beth:", hash_of("k9Lp" + "summer2026")[:16])

# Give Beth the salt "x7Q2" too. What happens to her hash?