Encoding vs Encryption vs Hashing

Encoding, encryption, and hashing are three fundamentally different operations that serve different purposes. They are often confused, but understanding the difference is essential for designing secure systems.

Encoding transforms data format without providing security. Encryption protects confidentiality. Hashing produces a fixed-length fingerprint for integrity verification.

Encoding converts data from one format to another for compatibility or transmission purposes. It is always reversible and requires no key. Anyone who knows the encoding scheme can decode the data.

Examples include Base64 (binary to ASCII), URL encoding (%20 for space), HTML entities (& for &), and hex encoding. The goal is compatibility, not security.

Encryption transforms plaintext into ciphertext using a key. The operation is reversible only by someone with the correct key. Without the key, ciphertext is computationally infeasible to decrypt.

Encryption algorithms include AES (symmetric), RSA (asymmetric), and ChaCha20. The key is what provides security. The algorithm itself is public knowledge.

A cryptographic hash function takes arbitrary-length input and produces a fixed-length output (the digest or hash). The function is deterministic (same input always gives same output) but irreversible by design.

SHA-256 always produces 256-bit output regardless of whether the input is 1 byte or 1 gigabyte. Hash functions are used for integrity checks, password storage, and digital signatures.

A critical and common mistake: Base64-encoded data is NOT encrypted. Decoding Base64 requires only the knowledge that it is Base64, which is often obvious from the "==" padding or character set.

If you encode a password as "cGFzc3dvcmQ=" (Base64 for "password"), an attacker can decode it in seconds. Base64 in a security context is only useful for transmission compatibility, never for hiding data.

Hashing a password with MD5 stores it as a one-way digest. You cannot "decrypt" an MD5 hash to recover the password. However, MD5 is not a suitable password hashing function because it is too fast.

Attackers can compute billions of MD5 hashes per second using GPUs, making brute-force and rainbow table attacks practical. Password storage requires slow, memory-hard functions like bcrypt, scrypt, or Argon2.

AES-GCM (Galois/Counter Mode) provides both confidentiality (encryption) and integrity (authentication). It uses AES in counter mode for encryption and GHASH for authentication.

The authentication tag produced by AES-GCM detects any tampering with the ciphertext. This makes it an Authenticated Encryption with Associated Data (AEAD) scheme, the gold standard for modern encryption.

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function standardized by NIST. It produces a 256-bit digest and is considered secure against all known attacks including collision and preimage attacks.

SHA-256 is used in TLS certificates, Bitcoin mining (proof-of-work), HMAC message authentication, and digital signature schemes like RSA-SHA256 and ECDSA.

Common security mistakes arising from confusion between these three: storing passwords encrypted instead of hashed (encryption key becomes the real vulnerability), using encoding instead of encryption for sensitive data, using fast hashes (MD5, SHA-1) for password storage, and assuming that because something is Base64 it must be secure.

Another mistake: using the same function for multiple purposes, such as using a hash function as a MAC without the HMAC construction, which is vulnerable to length extension attacks.

Use encoding when you need to transmit binary data over a text protocol, store bytes in a text field, or embed data in a URL. Use hashing for storing passwords (with bcrypt/Argon2), verifying data integrity (checksums), and deriving fixed-length identifiers from variable-length data.

Use encryption when you need to store or transmit sensitive data that must be recoverable with the right key. Combine hashing and encryption (AEAD) for both integrity and confidentiality in transit.

A well-designed authentication system uses all three: passwords are hashed with Argon2 (hashing), the hash is stored in a database field with AES-256 column encryption (encryption), and the API token returned after login is Base64url-encoded (encoding).

Each operation serves a distinct purpose. Recognizing which operation is appropriate for which use case is a fundamental skill in applied cryptography and secure system design.

Test your understanding of encoding, encryption, and hashing.

Encoding (Base64, hex) is format transformation with no security. Encryption (AES-GCM) provides reversible confidentiality requiring a key. Hashing (SHA-256, Argon2) produces irreversible fixed-length digests.

Never use encoding for security. Use slow hashes (Argon2/bcrypt) for passwords. Use authenticated encryption (AEAD) for sensitive data in transit or at rest. Confusing these categories is one of the most common sources of security vulnerabilities.