A blender versus a lockbox
A hash is like a blender. Fruit goes in, smoothie comes out, and you cannot get the banana back. Websites often store a mixed form so they can check “does this password blend to the same smoothie” without keeping the banana.
Encryption is a lockbox. You will need the banana later—the actual site password—to sign in. So the manager must be able to open the box with a key. That is why saved logins are encrypted, not merely hashed.
Where each tool belongs
Checking a sign-in: you do not want a server to keep the raw password. Slow password hashing or a protocol like OPAQUE is about that check.
Storing a login you will reuse: you need encryption, on the device if you care about privacy. Stax Pass seals those records with XChaCha20-Poly1305 and stretches your main password with Argon2id.
A fast hash like SHA-256 alone is a poor way to protect a human password against guessing. It was not built to be expensive.
What to listen for
If a product says only “we hash everything,” ask how you ever see a saved password again. If they say only “we encrypt,” ask when, where, and who has keys. Specific answers are a form of respect. Slogans are not.
Is this worth paying for?
You should not need a glossary to buy a lock. You should still hear the difference between a blender and a box, because it tells you whether a company can read your vault. Stax Pass publishes the split. The trial is there so you can use the box before you pay for it.
Take this with you
- Hashing is for checking. Encryption is for storing something you will open.
- Saved site passwords must be encrypted, not only hashed.
- Ask when encryption happens and who can reverse it.
Common questions
Is hashing more secure than encryption?
Neither is “more secure” in the abstract. They answer different questions. Using the wrong one is the failure.
Why can I still copy a password out of Stax Pass?
Because you unlocked the box. After unlock, you can use the login. Before unlock, the stored copy is sealed.
Does hashing mean a company cannot leak passwords?
They can still leak the hashed file. Weak or fast hashes can be guessed. Unique passwords still matter on every site.