What Is a Password Hash?
A password hash is the fixed-length cryptographic output that a system stores in place of a user's actual password. It comes from a one-way function that is easy to compute from the password but computationally infeasible to reverse.
Unlike encryption, which a key can undo, a hash has no key that turns the digest back into the password, so a system that stores hashes never has to hold the plaintext at all.
How password hashing works
A cryptographic hash function maps an input of any length to a fixed-length digest. Cryptographic hash functions require three properties:
- Collision resistance
- Preimage resistance (the one-way property)
- Second preimage resistance
The function is deterministic (opens in new tab), so an identical password always produces the same digest, while a small input change produces a drastically different one.
General-purpose hash functions are only the starting point. Secure password storage under federal guidance (opens in new tab) requires systems to salt memorized secrets and hash them with a suitable one-way key derivation function. A key derivation function takes the password and a random salt as inputs and applies a tunable cost factor, so its deliberate slowness makes each guessing attempt expensive for an attacker who has stolen the hash file.
In practice, when a user registers with the password "Summer2026!", the server generates a random salt, runs the password and salt through a function such as Argon2id, and stores the salt and the resulting digest. At the next login, the server repeats the computation on the password the user submitted.
A matching digest authenticates the user, and the server discards the plaintext either way.
Why password hashes matter
Password hashing determines whether a stolen authentication database becomes a mass credential compromise. Attackers who exfiltrate hashes usually move them to their own hardware and run offline cracking (opens in new tab), where login prompts and lockouts do not apply.
Implementation choices decide the outcome: unsalted hashes (opens in new tab) preserve the precomputation advantage of rainbow tables, and fast functions like MD5 and SHA-1 (opens in new tab) let commodity GPUs test guesses quickly enough to recover passwords.
Attackers pull hash dumps (opens in new tab) from breached application databases and domain controllers, then use GPU hardware (opens in new tab) to compare candidate-password hashes against the stolen values. Recovered credentials feed credential stuffing wherever employees reuse passwords, so one cracked login can open a second, unrelated account.
Cracking is only one path. In a pass-the-hash attack (opens in new tab), the attacker submits the stolen hash itself as the credential and moves laterally without ever recovering the plaintext.
Core components of secure password hashing
A hardened password store combines four elements:
- A slow, memory-hard algorithm. Argon2id is the first choice for storage (opens in new tab), then scrypt, then bcrypt for legacy systems. Argon2 won the 2015 Password Hashing Competition (opens in new tab) and is standardized in RFC 9106. Fast general-purpose functions do not qualify: NIST began retiring SHA-1 (opens in new tab) in December 2022, with full phase-out by December 31, 2030, and standalone SHA-256, while sound for integrity checks, computes too quickly to resist offline guessing.
- A unique salt per credential. A salt is a random value combined with each password before hashing, so identical passwords produce different hashes and precomputed rainbow tables lose their advantage. The server stores the salt alongside the hash, and it does not need to be secret. Salting alone is not enough, though: a slow key derivation function (opens in new tab) supplies the per-guess cost that a salt cannot.
- A pepper. A pepper is a secret applied across all stored passwords and kept outside the password database. Under the 2025 revision of federal guidance (opens in new tab), verifiers should add this keyed operation and store the secret separately from the hash database, preferably in hardware such as an HSM or TPM. Changing a compromised pepper forces a password reset (opens in new tab) for every user it protected.
- A tunable work factor. Memory, iteration, and parallelism parameters control how expensive each guess is. For Argon2id, the OWASP baseline is 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.
Raising these as hardware improves keeps a guessing attack prohibitively expensive.
How to defend against password hash attacks
Storage-side discipline comes first. Meet the NIST and OWASP requirements above, screen every new password (opens in new tab) against prior breach corpuses, and rate-limit failed logins. Current NIST guidance (opens in new tab) leans on length and breach screening, dropping mandatory complexity rules and periodic resets, because forced rotation pushes users toward predictable patterns.
Account-side controls cover what hashing cannot. FIDO/WebAuthn phishing-resistant MFA (opens in new tab) blocks logins to fake sites. Monitor for exposed credentials, because infostealers (opens in new tab) harvest passwords, session cookies, and access tokens that circulate through dark web marketplaces.
When the security team confirms exposure, force a password reset and revoke active sessions (opens in new tab), because a stolen session cookie keeps working after a password change (opens in new tab).
Hashing protects credentials at rest in a database; entry, transmission, and active sessions need their own controls. A phishing page harvests plaintext directly (opens in new tab), and an adversary-in-the-middle kit captures an authenticated session cookie.
Groups like Scattered Spider (opens in new tab) talk help desks into resetting passwords and MFA tokens outright.
How Doppel helps
Password hashing protects the credential store; it does nothing about the fake login pages and lookalike domains that harvest a password before it is ever hashed. Doppel is the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management, and it goes after that credential-harvesting infrastructure directly.
Brand Protection detects and dismantles the lookalike domains and fake login pages that steal credentials in the first place. The Doppel Threat Graph correlates that impersonation infrastructure into campaign-level views, and agentic AI drives the takedowns at scale while analysts handle the novel cases.
A guided demo traces a credential-harvesting page back to the campaign behind it and shows how the platform makes your brand too costly to attack. Request a demo to get started.
Frequently asked questions about password hashes
What is a password hash?
A password hash is the fixed-length output of a one-way cryptographic function that a system stores in place of the user's actual password. At login, the system hashes the submitted password and checks it against the stored hash, so it never keeps the plaintext in the password database. Password hashes need a salt and a slow key derivation function such as Argon2id to resist offline cracking.
Can a password hash be reversed?
No. Hashing is a one-way function, so deriving the original password from its hash requires impractical computational effort. What attackers call "cracking" is running candidate passwords through the same hash function until an output matches the stolen hash, which relies on guessing rather than inversion. Slow, memory-hard algorithms exist precisely to make that guessing expensive.
What is the difference between password hashing and encryption?
Hashing is one-way and produces a fixed-length digest that resists reversal. Encryption is two-way, so anyone holding the key can recover the original data. Password storage standards direct teams to hash passwords with adaptive algorithms rather than store them under reversible encryption, which would leave them recoverable.
What is an example of a password hash attack?
A pass-the-hash attack lets an attacker submit a stolen password hash itself as the credential and move laterally through a network without recovering the plaintext; MITRE ATT&CK classifies this as a credential-access technique (opens in new tab). Offline cracking is the other common pattern: attackers dump hashes from a breached database or a domain controller, then run dictionary and brute-force guesses against them on their own GPU hardware, where no account lockouts apply. Both techniques depend on first stealing the hash from a compromised system, which is why hash storage standards and credential-exposure monitoring work together.