A hash function has three properties that make it useful. The same input always gives the same output, so a fingerprint can be compared later. A tiny change in the input gives a completely different output, so tampering shows. And the output cannot be worked backwards to the input, so publishing the fingerprint reveals nothing about the data. Those properties make hashes the tool for verifying a downloaded file, detecting a changed record, and storing a password in a form that lets you check a login without ever holding the password itself.
- Integrity: a file's published hash lets you confirm the copy you downloaded is the one the author released.
- Passwords: the system stores the hash, hashes what you type at login, and compares; the password itself is never stored.
- Deduplication and indexing: identical content produces identical hashes, so a system can spot duplicates without comparing the content.
- Signatures: a digital signature is made over the hash of a document rather than the document, because the hash is small and the document may not be.
The password case has its own rules, and general-purpose hash functions fail them. A fast hash like SHA-256 is designed to be quick, which is exactly what an attacker with a stolen database wants: billions of guesses a second. Password hashing uses deliberately slow functions such as bcrypt, scrypt or Argon2, tuned so that each guess costs real time, and adds a salt, a random value stored with each hash, so that two users with the same password have different hashes and precomputed tables are useless. Older functions such as MD5 and SHA-1 are broken for collision resistance and should not appear in new systems for any security purpose.
Hashing is not encryption, and the difference is the point
Encryption can be reversed by whoever holds the key; that is what it is for. A hash cannot be reversed by anyone, including the system that made it. A service that offers to recover your original password is either storing it in the clear or encrypting it with a key it also holds, and in either case a breach exposes every password at once.