SHA vs Encryption Interview Questions and Answers
Top 10 SHA vs Encryption interview questions with Mermaid diagrams, production scenarios, and enterprise security best practices.
SHA vs Encryption - Interview Questions & Answers
One of the most frequently asked security interview questions is the difference between SHA (Secure Hash Algorithm) and Encryption. Although both transform data into another form, they serve completely different purposes.
Encryption protects confidentiality by allowing data to be decrypted later, whereas SHA is a one-way hashing algorithm primarily used for integrity verification.
Q1. What is SHA?
Answer
SHA (Secure Hash Algorithm) is a family of cryptographic hash functions that converts input data into a fixed-length hash value.
Unlike encryption, SHA is a one-way function, meaning the original data cannot be recovered from the hash.
SHA Hashing Flow
flowchart LR
A[Plain Text] --> B[SHA-256] --> C[Hash Value]
Example
Input
CodeWithVenu
SHA-256 Output
6f1c2d1c9b5d...
The output always has a fixed length regardless of the input size.
Q2. What is Encryption?
Answer
Encryption converts readable data into unreadable ciphertext using an encryption key.
The encrypted data can later be decrypted using the appropriate key.
Encryption Flow
flowchart LR
A[Plain Text] --> B[Encryption Algorithm] --> C[Secret Key] --> D[Cipher Text] --> E[Decryption Key] --> F[Plain Text]
Examples
- AES
- RSA
- ECC
Encryption protects sensitive information from unauthorized access.
Q3. What is the difference between SHA and Encryption?
Answer
| SHA | Encryption |
|---|---|
| One-way | Two-way |
| Cannot recover original data | Original data can be decrypted |
| Used for Integrity | Used for Confidentiality |
| No encryption key | Uses encryption keys |
| SHA-256 | AES, RSA |
Comparison Diagram
flowchart TD
A[Original Data]
A-->B[SHA-256]
B-->C[Hash]
A-->D[AES]
D-->E[Encrypted Data]
E-->F[Decrypt]
F-->G[Original Data]
Interview Tip
Hashing is irreversible.
Encryption is reversible.
Q4. Where is SHA commonly used?
Answer
SHA is widely used for:
- Password Verification
- File Integrity
- Digital Signatures
- Certificate Validation
- Blockchain
- Git
- JWT Signatures
- API Request Verification
Enterprise Example
flowchart LR
A[Downloaded File] --> B[SHA-256]
C[Compare Hash] --> C[Compare Hash]
D[Integrity Verified] --> D[Integrity Verified]
If the calculated hash matches the original hash, the file has not been modified.
Q5. Why should passwords be hashed instead of encrypted?
Answer
Passwords do not need to be decrypted.
Applications only need to verify whether the entered password matches the stored password.
Password Verification
flowchart TD
A[User Password] --> B[BCrypt / SHA]
C[Stored Hash] --> C[Stored Hash]
D[Login Password] --> E[BCrypt / SHA]
F[Compare Hashes] --> F[Compare Hashes]
Best Practice
Never store passwords using encryption.
Instead, use:
- BCrypt
- Argon2
- PBKDF2
Interview Tip
SHA alone is not recommended for password storage because it is too fast.
Q6. What are SHA-1, SHA-256, and SHA-512?
Answer
SHA has several versions.
| Algorithm | Output Size | Recommendation |
|---|---|---|
| SHA-1 | 160 bits | Deprecated |
| SHA-224 | 224 bits | Limited Use |
| SHA-256 | 256 bits | Recommended |
| SHA-384 | 384 bits | High Security |
| SHA-512 | 512 bits | Very High Security |
Diagram
flowchart LR
A[SHA Family] --> B[SHA-1]
A-->C[SHA-256]
A-->D[SHA-384]
A-->E[SHA-512]
Enterprise Recommendation
Use SHA-256 or SHA-512 for integrity verification.
Q7. What is the difference between SHA and BCrypt?
Answer
Both generate hashes, but they serve different purposes.
| SHA | BCrypt |
|---|---|
| Very Fast | Intentionally Slow |
| Integrity Verification | Password Storage |
| No Salt by Default | Automatic Salt |
| Collision Resistant | Brute Force Resistant |
Password Storage Flow
flowchart LR
A[Password] --> B[BCrypt]
C[Salted Hash] --> C[Salted Hash]
D[Database] --> D[Database]
Interview Tip
For passwords, always choose BCrypt or Argon2 over SHA.
Q8. Can SHA be decrypted?
Answer
No.
SHA is mathematically designed to be irreversible.
Diagram
flowchart LR
A[Original Data] --> B[SHA-256]
C[Hash] --> C[Hash]
C-->D[Cannot Decrypt]
If the original data is lost, it cannot be reconstructed from the hash.
Q9. What are common mistakes when using SHA?
Answer
Common mistakes include:
- Using SHA for password storage.
- Using SHA-1 in new applications.
- Assuming hashes can be decrypted.
- Not using salting for passwords.
- Using custom hashing algorithms.
- Ignoring integrity verification.
Wrong Design
Password
↓
SHA-256
↓
Database ❌
Correct Design
Password
↓
BCrypt / Argon2
↓
Database ✅
Q10. What are the enterprise best practices for SHA and Encryption?
Answer
Follow these best practices:
- Use SHA-256 or SHA-512 for integrity verification.
- Use AES-256 for encrypting sensitive data.
- Use RSA/ECC for secure key exchange.
- Store passwords using BCrypt or Argon2.
- Never use SHA-1 in new applications.
- Never expect SHA hashes to be reversible.
- Verify file integrity using SHA.
- Rotate encryption keys regularly.
- Use trusted cryptographic libraries.
- Keep cryptographic algorithms up to date.
Enterprise Security Architecture
flowchart TD
A[Client] --> B[TLS 1.3]
C[Spring Boot API] --> C[Spring Boot API]
C-->D[AES Encryption]
C-->E[SHA-256 Integrity Check]
C-->F[BCrypt Password Hash]
D-->G[Encrypted Database]
Security Model
flowchart LR
A[Password] --> B[BCrypt]
C[Business Data] --> D[AES-256]
E[Downloaded File] --> F[SHA-256]
Senior Interview Tip
Enterprise applications use different cryptographic techniques for different purposes:
- AES-256 → Data Encryption
- RSA/ECC → Key Exchange
- SHA-256/SHA-512 → Integrity Verification
- BCrypt/Argon2 → Password Storage
- TLS 1.3 → Secure Communication
Choosing the right cryptographic algorithm for the right use case is a key expectation in senior-level security interviews.
Quick Revision
- SHA is a one-way hashing algorithm.
- Encryption is reversible.
- SHA verifies integrity.
- Encryption protects confidentiality.
- SHA-256 is recommended for integrity checks.
- AES is used for encrypting sensitive data.
- RSA is used for key exchange.
- BCrypt or Argon2 should be used for password hashing.
- SHA-1 is deprecated.
- Enterprise applications combine hashing, encryption, and secure key management for comprehensive security.