Computerphile
9 minutes
Why Passwords Are Hashed, Never Encrypted, Never Stored
Your app never needs to read a user's password — it only needs to recognise the right one later, so it stores a one-way hash instead of the password. Encryption is the wrong tool because anything you can decrypt, an attacker who takes your server can decrypt too. Storing the password itself means a single database leak hands out every account, on your site and on every other site where that password was reused.