Encoding vs Encryption

Encoding and encryption look similar because both transform data into something unreadable at first glance, but their goals are completely different.

• Encoding changes the format of data so it can be safely stored or transmitted.
• Encryption protects the confidentiality of data so only someone with a key can read it.

Confusing the two is one of the most common beginner mistakes in security.

Encoding uses a public, well-known scheme. There is no secret involved. Anyone who knows the scheme can decode the data instantly.

Common encodings include Base64, hex, URL encoding, and ASCII. They exist to make binary data survive text-only channels like email or HTTP headers.

Base64 represents binary data using 64 printable characters (A-Z, a-z, 0-9, + and /). It expands data by about 33 percent. A trailing = is padding.

You can decode it on any Linux box with no key at all:

As a hacker you will see Base64 everywhere: JWT tokens, cookies, config files, and exfiltrated data. Clues that a blob is Base64:

• Only contains A-Za-z0-9+/ and maybe = padding.
• Length is a multiple of 4.
• Decodes into readable text or recognizable file headers.

Always try decoding suspicious strings before assuming they are encrypted.

Hexadecimal encoding represents each byte as two characters (0-9, a-f). It is heavily used in network captures, memory dumps, and hash outputs.

The byte values 0x68 0x69 spell the ASCII text 'hi'.

Encryption applies a cipher plus a secret key. Without the key, the output (ciphertext) is computationally infeasible to reverse.

• Plaintext = the original readable data.
• Ciphertext = the encrypted output.
• Key = the secret that controls encryption and decryption.

Change the key and the ciphertext changes completely.

The Caesar cipher shifts each letter by a fixed amount. With a shift of 3, A becomes D. It is a teaching example only because there are just 25 possible keys, so it is trivially broken by brute force.

ROT13 is a Caesar cipher with shift 13. It is technically a cipher but offers zero real security.

Real encryption uses algorithms like AES (symmetric) and RSA (asymmetric). These rely on large keys and hard mathematical problems instead of secrecy of the algorithm.

Kerckhoffs's principle: a cryptosystem should be secure even if everything about it except the key is public. Security comes from the key, never from hiding the algorithm.

A key difference you can observe: good ciphertext looks like high-entropy random noise. Encoded data does not.

• Base64 of 'hello' is always aGVsbG8= for everyone.
• AES of 'hello' changes with the key and an initialization vector, producing different output each time.

If decoding a string gives readable text without any key, it was encoded, not encrypted.

During an assessment you constantly find obscured data. Asking 'is this encoding or encryption?' guides your next move:

• Encoded? Decode it now, no key needed. Credentials hidden in Base64 are an instant win.
• Encrypted? Find the key, attack key management, or look for implementation flaws.

Treating encoding as if it were security is a vulnerability you will report constantly.

Beware a third category: obfuscation. This is deliberately making data hard to read (minified JS, packed binaries, XOR with a fixed byte) without a real cipher or key management.

Like encoding, obfuscation provides no genuine confidentiality. It only slows down a casual observer. Skilled analysts reverse it routinely.

Test your understanding of the core distinction.

You learned the crucial difference between encoding and encryption:

• Encoding (Base64, hex) is reversible by anyone and only changes format.
• Encryption (AES, RSA) needs a secret key and protects confidentiality.
• Obfuscation hides but does not secure.
• Always decode suspicious strings first; ciphertext looks like random noise while encoded data decodes to readable content without a key.

Next you will dive into hashing, a one-way transformation that is different from both.