Hashing vs Encryption: MD5, SHA-256, and AES Explained Simply

"Hashing" and "encryption" are two of the most commonly confused terms in software security. They both turn readable data into something scrambled, so it is easy to assume they are interchangeable. They are not. They solve fundamentally different problems, and using the wrong one — for example, "encrypting" passwords when you should be hashing them — is a classic and dangerous mistake. This guide explains the difference in plain language and shows where MD5, SHA-256, and AES each belong.

The one-sentence difference

Encryption is reversible; hashing is not. Encryption is a two-way transformation designed so that someone with the correct key can recover the original data. Hashing is a one-way transformation designed so that the original data cannot be recovered from the output at all.

That single property — reversible vs one-way — drives every other difference and decides which tool you should use.

What is hashing?

A hash function takes an input of any size and produces a fixed-length "fingerprint" called a hash or digest. The same input always produces the same hash, but you cannot run the process backward to get the input from the hash. Good cryptographic hash functions also have two important properties:

• Avalanche effect: changing even one character of the input completely changes the output
• Collision resistance: it is computationally infeasible to find two different inputs with the same hash

Watch the avalanche effect with SHA-256:

SHA-256("hello") =
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

SHA-256("Hello") =
185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

A single capital letter produces an entirely different digest. Try it yourself with the SHA-256 Generator or the multi-algorithm Hash Generator.

MD5 vs SHA-256

MD5 and SHA-256 are both hash functions, but they are not equally trustworthy today.

MD5 is fine for a quick non-security checksum (for example, detecting accidental file corruption) but must never be used where an attacker might try to forge data. SHA-256 is the modern default.

What is encryption?

Encryption scrambles data using a key so that only someone with the right key can unscramble (decrypt) it. Unlike hashing, the whole point is that the transformation is reversible — for authorized parties. There are two broad families:

• Symmetric encryption uses the same key to encrypt and decrypt. AES is the dominant standard.
• Asymmetric encryption uses a public key to encrypt and a private key to decrypt (RSA, ECC). This powers HTTPS and digital signatures.

AES (Advanced Encryption Standard) is the workhorse of symmetric encryption. It is fast, widely audited, and used to protect files, disks, databases, and network traffic. You can experiment with it using the AES Encryption tool.

Side-by-side comparison

Which one should you use?

Storing passwords → hashing (with a salt)

Never encrypt passwords, and never store them in plain text. Hash them, because you never actually need to recover the original password — you only need to check whether a login attempt produces the same hash. Critically, use a slow, salted password hash such as bcrypt, scrypt, or Argon2 rather than plain SHA-256, and add a unique random salt per user so identical passwords produce different hashes and precomputed "rainbow table" attacks fail.

Verifying a download or detecting tampering → hashing

Publishers post a SHA-256 hash next to a download. You hash the file you received and compare. If the hashes match, the file is intact; if not, it was corrupted or altered.

Protecting data that must be read again later → encryption

When you need to store or send data secretly but recover it later — a private message, a stored API key, a backup — you encrypt it with AES and guard the key.

Proving a message came from you and was not changed → HMAC

An HMAC combines a hash with a secret key to prove both integrity and authenticity. Webhooks and APIs use HMAC signatures so the receiver can confirm a request genuinely came from the expected sender. See the HMAC Generator to see how it works.

A common mistake to avoid

Do not confuse encoding (like Base64) with either of these. Base64 has no key and no secrecy — it is trivially reversible by anyone and provides no protection whatsoever. If you have ever seen a "secured" value that turned out to be Base64, it was not secured at all. We cover that distinction in Base64 encoding explained.

Try the tools

Conclusion

The rule is simple: if you ever need to read the data again, encrypt it; if you only ever need to verify it, hash it. Use SHA-256 over MD5 for anything security-related, salt and slow-hash your passwords, reach for AES when confidentiality matters, and use HMAC when you need to prove authenticity. Get this choice right and you avoid the most common and most damaging security mistakes in application development.