← Years 9–10 Digital Systems

Why passwords are stored as hashes

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 24, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 76, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 103, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 149, QCE Digital Solutions Unit 2 — Data and Programming Techniques — Module 117, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 40, WA Computer Science ATAR Year 11 — Cyber Security — Module 88

Understanding Why passwords are stored as hashes in Years 9–10 Digital Systems

What it does: Hashing the same password twice produces an identical value, which is why a login check by comparing hashes works. Hashing is one-way. A stolen hash can't be turned back into the password, so the thief only gets scrambled values (though they might still try to guess passwords). If the hashes don't match, the password typed is not the one that was originally set. Even a small change to the input gives a very different hash.

Common mistakes: The system should store the hash of the password, not the real password. It should be stored ← hash(password), so a stolen database does not reveal real passwords. This hashes the username instead of the password. The password is what needs protecting, so it should be stored ← hash(password).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Why passwords are stored as hashes to a class →

This module's key terms are also in a printable crossword (Modules 13–24) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A website stores your password. Which is the safer way to store it?

Store a hash of the passwordStore the real password so it can be checked easily

Matches

stored_password = "cat123"

↓

The real password is saved in plain text. If the database is stolen, the thief can read every password straight away.

Applying

Meanings

Term

hash

Meaning

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

Practice

stored_hash ← hash(password)

Testing

Gaps

stored ← (password)

Check Answer

Spots

1stored ← password

2save(user, stored)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A website stores your password. Which is the safer way to store it?

A. Store a hash of the password ✓

B. Store the real password so it can be checked easily

Storing a hash means the system never keeps your real password. If the data is stolen, the thief doesn't get the passwords straight away.

2. You log in with the password 'blue42'. The system hashes what you typed. What does it do next?

A. Unscrambles the stored hash back into 'blue42'

B. Compares the new hash to the stored hash ✓

A system checks a login by hashing your input and comparing the two hashes. It never needs to reverse the hash.

3. Two users type exactly the same password with the same hashing method. What happens?

A. They get the same hash ✓

B. They get two completely different hashes

The same input always gives the same hash. That is how a login check can work. It is also why salting is used (covered in a later module).

4. Which statement about a hash is true?

A. It can be decoded with the right key

B. It can't be reversed back into the password ✓

A hash is one-way. There is no key to unlock it. Attackers can only guess passwords and hash each guess to see if it matches.

5. A hacker steals a database that only holds password hashes. What do they get?

A. Scrambled values, not the real passwords ✓

B. A list of every user's real password

A stolen hash database doesn't show the passwords directly. The thief has to guess passwords and compare hashes, which takes effort.

Match the Pairs

hash("cat123") → 8f3a91c2 → The password is turned into a scrambled value that gets stored instead of the real password

hash(attempt) == stored_hash → The login check: hash what the user typed and compare it with the saved hash

The same input always gives the same hash, so a correct password matches the stored hash → hash("cat123") == hash("cat123")

A hash can't be reversed, so a thief with the database can't simply read the passwords → unhash("8f3a91c2") → impossible

stored_password = "cat123" → The real password is saved in plain text. If the database is stolen, the thief can read every password straight away.

if attempt == stored_hash: → The typed password is compared directly with the hash. The attempt must be hashed first, so they will never match.

Key Term

hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

Fill in the Blanks

1. stored ← hash(password)

Hint: Type the function name that turns a password into a one-way scrambled value.

2. stored ← hash(password) IF hash(attempt) = stored THEN OUTPUT "Login ok"

Hint: Type the comparison operator that checks if the new scrambled value matches the saved one.

3. h1 ← hash("sunny") h2 ← hash("sunny") IF h1 = h2 THEN OUTPUT "Same"

Hint: Type the variable that holds the second scrambled value made from the same input.

4. INPUT password SAVE hash(password) TO database

Hint: Type the variable that holds what the user typed in, so only its scrambled value is saved.

5. INPUT password stored ← hash(password)

Hint: Type the assignment symbol that puts the scrambled value into the variable.

Spot the Error

Question 1

A stored ← password

B save(user, stored)

C print('Account created')

Line A — The system should store the hash of the password, not the real password. It should be stored ← hash(password), so a stolen database does not reveal real passwords.

Question 2

A password ← input('New: ')

B stored ← hash(user)

C save(user, stored)

Line B — This hashes the username instead of the password. The password is what needs protecting, so it should be stored ← hash(password).

Question 3

A typed ← input('Password: ')

B attempt ← hash(typed)

C stored ← load(user)

D IF typed = stored THEN

E print('Welcome')

Line D — This compares the plain typed password with the stored hash, so they will never match. It should compare the hash of what was typed: IF attempt = stored THEN.

Question 4

A theft ← stolen_hash

B guess ← reverse(theft)

C IF hash(guess) = theft THEN

D print('Guess matches')

Line B — A hash cannot be reversed back to the password. A thief can only guess a password, hash it and compare, so it should be guess ← 'mango7'.

Question 5

A h1 ← hash('Fish99')

B h2 ← hash('fish99')

C print(h1 = h2)

Line B — The same input always gives the same hash, but a different input (even just a different capital letter) gives a different hash. For h1 = h2 to be true, line 2 must be h2 ← hash('Fish99').

Student with a class code? Join your class →