Encryption, Hashing and Defensive Hash Checks Explained
Understand reversible encryption, one-way hashes, checksums, password hashing, and limited wordlist comparisons.
Encryption and hashing solve different problems
Encryption is reversible with the correct key and protects data that must later be recovered. A cryptographic hash produces a fixed-length digest and is designed to be one-way. Hashes help compare data and detect changes, but ordinary fast hashes are not suitable for storing passwords.
Using the KitBeam tools
- Use AES encryption only for text you are authorized to process, and preserve the password and returned format.
- Use the hash generator for checksums, test vectors, or interoperability checks.
- Use the basic hash checker only with authorized data and a small candidate list.
Password storage requires a slow design
MD5, SHA-1, SHA-256, and SHA-512 are fast general-purpose digests. Password systems should use a unique salt and a purpose-built algorithm such as Argon2, scrypt, bcrypt, or PBKDF2 with reviewed parameters. A salt prevents identical passwords from having identical stored values; it is not a secret key.
Interpret “not found” carefully
A wordlist comparison only proves that none of the tested candidates matched under the selected algorithm. It does not establish that the original input is strong. Likewise, matching a checksum confirms byte equality under that digest, not authenticity unless the expected checksum came through a trusted channel.