Password hashing runs a password through a one-way function that produces a fixed fingerprint which cannot be turned back into the password. You store the hash, not the password, so if your database leaks, the actual passwords are not exposed. To check a login you hash the attempt and compare, never decrypting anything.
Why hashing, not encryption
Encryption is reversible: anyone with the key can recover the password, so a key leak is a password leak. Hashing is one-way by design, so there is nothing to reverse. You never need the original password back, only to check whether a submitted one matches, which a hash does perfectly.
Why the algorithm matters
Fast hashes like MD5 or SHA-256 are wrong for passwords, because an attacker can compute billions of guesses per second against a leaked database. Use a slow, salted, purpose-built algorithm such as bcrypt, scrypt, or argon2, which are deliberately expensive to compute and include a per-password salt to defeat precomputed tables.
What this means for AI-generated code
AI tools sometimes reach for a plain SHA-256 or even store passwords with light or no hashing, because it produces working login code. The difference only matters after a breach, so the weak choice passes every test until it is too late.