Hashing, encoding and encryption

Base64 is a public rule, not a secret, so the command that reverses it is the same tool with -d and needs nothing else. A hash is one way: the digest is shorter than the input, so information is thrown away and it cannot be undone. Encryption is meant to be reversed, but only by someone holding the key. That is why base64 of a password is not protection at all.

The eight characters U2FsdGVkX1 decode to the word Salted__ followed by two more bytes. It is a header, not part of your message, and it is present whenever openssl enc derives a key from a passphrase. It says a random salt was used, which is why the same passphrase produces different ciphertext each time. The message itself begins after the header.

A hash of any input is always 256 bits, while the input can be longer, so the operation throws information away. Many different inputs map to the same digest, which means the digest on its own cannot say which input produced it. This is different from encryption, where the key is what holds the door shut. With a hash there is no door to open, only a summary of what went in.

The published hash is a fingerprint of the exact file the vendor released. If your copy produces a different digest, then your copy is not that file, whether because the download was damaged or because someone changed it. That is the whole point of publishing a hash. It does not mean the algorithm failed, and it says nothing about encryption, which is a different job entirely.