The Difference Between Encryption, Encoding, and Hashing

Few concepts cause more confusion in security discussions than encryption, encoding, and hashing. They all transform data in some way, but they serve completely different purposes and should never be confused with each other.

Encoding: Transformation, Not Protection

Encoding converts data from one format to another using a publicly known scheme. Anyone can reverse it without any key or secret.

Common encoding formats:

Base64 converts binary data to printable ASCII characters. It is used to embed images in HTML, encode email attachments, and transmit binary data over text protocols. SGVsbG8= decodes to Hello. Anyone with a Base64 decoder can read it immediately.

URL encoding replaces special characters with percent sequences. A space becomes %20, an ampersand becomes %26. This is purely about safe transmission in a URL, not protection.

HTML entities replace special characters with references like & for & and < for <. This prevents browsers from interpreting user-supplied content as HTML markup.

The critical point: encoding provides zero security. If you store a password as Base64, it is not protected -- it is just slightly harder to read at a glance. Any attacker who sees cGFzc3dvcmQ= will decode it to password in seconds.

Encryption: Reversible With a Key

Encryption transforms data so that only someone with the correct key can reverse it. The same plaintext encrypted with different keys produces completely different ciphertext. Without the key, decryption is computationally infeasible.

Symmetric encryption uses the same key to encrypt and decrypt. AES-256 is the industry standard for symmetric encryption. It is fast and used for encrypting files, disk volumes, and data at rest.

Asymmetric encryption uses a public key to encrypt and a private key to decrypt (or vice versa for signatures). RSA and elliptic curve algorithms fall into this category. HTTPS uses asymmetric encryption during the handshake to exchange a symmetric session key, then switches to symmetric encryption for speed.

When to use encryption: when you need to retrieve the original data later. Credit card numbers stored for future charges, personal data that needs to be read back, encrypted backups.

Hashing: One-Way Transformation

A hash function takes input of any size and produces a fixed-length output. The same input always produces the same hash. Even a one-character change in the input produces a completely different hash. And crucially, you cannot work backwards from the hash to the original input.

Common hash functions:

SHA-256 produces a 256-bit (64 hex character) hash. It is used in SSL certificates, code signing, and blockchain proof-of-work. SHA-256('hello') = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

bcrypt, Argon2, scrypt are password hashing functions designed to be slow. Slowness is a feature: attackers trying to crack password hashes by guessing billions of candidates per second are slowed down dramatically.

MD5 and SHA-1 are broken for security purposes. MD5 can be cracked to produce collisions (two different inputs with the same hash), which breaks applications that rely on hash uniqueness.

The Common Mistakes

Storing passwords with encoding: The password hunter2 encoded as Base64 is aHVudGVyMg==. This is not protected. Use a proper password hashing function.

Storing passwords with a fast hash: SHA-256 is fast by design, which makes it easy to brute-force. Use bcrypt, Argon2, or scrypt for passwords.

Encrypting passwords instead of hashing them: If you encrypt passwords, you can decrypt them -- which means your system holds a decryptable copy. If your encryption key is compromised, all passwords are exposed. Hash passwords; you never need the original.

Using the wrong algorithm for integrity checking: MD5 was once used to verify file downloads. It is now trivial to create a malicious file with the same MD5 as the legitimate one. Use SHA-256 or SHA-512.

Quick Decision Guide

Need to transmit binary data as text? Use encoding (Base64).

Need to store something you will need to retrieve later? Use encryption.

Need to store passwords or verify file integrity? Use hashing.

Need to check whether a password is correct without storing the password? Hash the candidate and compare the hashes.

The Encoding Toolkit and Hash Generator tools on this site let you experiment with these transformations directly.