StringMash.com

Encoding vs encryption vs hashing

Three ways to transform data, and the one question that separates them: who can undo it?

The short answer

Encoding changes data into another format so it can travel or be stored, and anyone can reverse it: there's no secret. Encryption keeps data confidential, and only someone with the key can reverse it. Hashing makes a fixed-length fingerprint of data, and nobody can reverse it. Base64 is encoding, AES is encryption, SHA-256 is hashing.

One input, three ways

The same text, encoded, encrypted and hashed. Change it and watch all three.

Base64Reversible by anyone
SGVsbG8sIHdvcmxk16 characters, 16 bytes
Encrypted (demo)Reversible with key
oMxBXkmE+r+MO2LRxf4IxzbeCWpHj1HDJ14QuChAuwhlNlyZsum/Jdw8LrVSr0RlTcbsQP9T/rA=76 characters, 76 bytes
SHA-256One-way
4ae7c3b6ac0beff671efa8cf57386151c06e58ca53a78d83f36107316cec125f64 characters, 64 bytes
Open the Base64 encoder →

Side by side

EncodingEncryptionHashing
GoalMake data fit a format or channelKeep data secretFingerprint or verify data
Who can reverse itAnyoneWhoever has the keyNobody
KeyNoneYesNone
Output sizeDepends on the schemeAbout the input size, plus a littleFixed
ExamplesBase64, URL encoding, UTF-8, hexAES, ChaCha20, RSASHA-256, SHA-3, MD5 (broken)

What is encoding?

Data encoding is a set of rules for writing data in a particular form. UTF-8 writes text as bytes. Base64 writes bytes as letters and digits so they survive email and JSON. URL encoding writes characters that aren't allowed in a URL as % codes. In every case the rules are public, and decoding is just running them backwards.

The word means other things elsewhere, such as how memories form in psychology, or how video is compressed. Here it's only about representing data.

Is Base64 encryption?

No, and treating it as if it were is a common mistake. Base64 hides nothing: anyone can decode it in a second, with no key. A password or token that's "only Base64" is effectively plain text. If something needs to stay secret, encrypt it.

Where hashing fits

Hashing is the odd one out because it doesn't keep the data at all. That makes it right for checking things, such as whether a download is intact or a password is correct, and wrong for anything you need to read again. Hashing vs encryption goes into that difference and into password storage.

Questions

Is encoding the same as encryption?

No. Encoding has no key and anyone can reverse it. Encryption needs a key to reverse.

Is hashing a kind of encryption?

No. Encryption is reversible with a key; a hash can't be reversed by anyone.

Is URL encoding secure?

It's not meant to be. It only makes characters safe to put in a URL.

Sources

Added . What's new