Why you cannot reverse a hash

A common request is to "decrypt" or "reverse" a hash back to the original text. It cannot be done, and not because the right tool is missing. A hash is a one-way function by design, and the reason it cannot be undone is built into what a hash is.

A hash is a one-way function

Encryption is two way: you encrypt with a key and decrypt with a key to get the exact input back. A hash has no key and no inverse. It is a one-way function, meaning it is easy to compute in the forward direction and infeasible to run backward.

• Forward: given the input, computing the hash is fast and deterministic.
• Backward: given the hash, there is no procedure that recovers the input.

This is a feature. It is what lets you verify a password or a file without storing the original.

Fixed output means information is lost

Here is the concrete reason reversal is impossible. A hash produces a fixed size output no matter how large the input is. A 256 bit hash returns 256 bits whether you feed it one character or a gigabyte file.

"hi"                 → 64 hex chars
a 2 GB video file    → 64 hex chars

A gigabyte of input cannot be packed into 256 bits without throwing information away. The output simply does not contain enough data to reconstruct the input, because most of the input was discarded in producing it. Reversing would mean recovering information that is no longer there. This also means many inputs map to the same output, as explained in what is a hash collision.

What cracking actually is

When someone says a hash was cracked, nothing was reversed. The attacker guessed an input, hashed it the same way, and checked whether the result matched.

for guess in candidate_passwords:
    if hash(guess) == stolen_hash:
        print("found:", guess)   # matched by guessing, not reversing

That is why weak and common inputs fall fast: they are near the top of the guess list. It is also why a strong, high entropy input is safe even though the hash is public. There are too many possibilities to guess, and reversing is off the table. The strength of the input is the whole game, which is why password entropy matters so much.

What follows from this

Several practical rules come straight out of the one-way property.

• You cannot look up "the password" from a hash. You can only confirm a guess.
• A hash is not a way to hide recoverable data. If you need to get the original back, you need encryption, not hashing.
• Protecting a hash is about making guessing expensive: a unique salt and a slow algorithm, covered in salting and peppering password hashes.

To see the one-way behavior directly, the Hash Generator hashes any text and shows the same fixed length output regardless of input size, all in your browser so nothing you enter is sent anywhere. Change one character and the whole digest changes, with no way to work back from it.

The short version: a hash cannot be reversed because the output is too small to hold the input and there is no inverse function. Cracking is guessing plus hashing, so your security rests on the input being hard to guess.