I know that hashes are used to bring the plaintext password in the right length for the encryption algorithm key. But is the password hash stores outside the encrypted container to validate the password? If so isn´t this a security vulnerability? Instead of attacking the encryption the attacker could just crack the hash. Is that how tools like rar2john or zip2john work?
If not how do they work, and why is the hash stored on the outside of the encrypted container?