Use a library. It’s far too easy for developers or project managers to fuck up the minimum requirements for safely storing passwords.

But, if you are wanting to do it by hand…

• Don’t use a regular hashing algorithm, use a password hashing algorithm
• Use a high iteration count to make it too resource-intensive to brute force
• Salt the hash to prevent rainbow tables
• Salt the hash with something unique to that specific user so identical passwords have different hashes

A KDF is not reversible so it’s not encryption (a bad one can be brute forced or have a collision, but that’s different from decrypting it even if the outcome is effectively the same). As long as you’re salting (and ideally peppering) your passwords and the iteration count is sufficiently high, any sufficiently long password will be effectively unrecoverable via any known means (barring a flaw being found in the KDF).

The defining characteristic that separates hashing from encryption is that for hashing there is no inverse function that can take the output and one or more extra parameters (secrets, salts, etc.) and produce the original input, unlike with encryption.