Encoding vs Encryption vs Hashing
Encoding, encryption, and hashing all transform data, which is why they get mixed up — but only two involve security, and only one keeps secrets. Encoding is about format. Encryption is about confidentiality. Hashing is about verification. Choosing the wrong one, especially mistaking encoding for protection, is a genuine and common security failure.
What does each one actually do?#
- Encoding converts data into another format for safe transport or storage — Base64, URL encoding, hex. It is fully reversible by anyone, uses no key, and provides no security. Its job is compatibility, not secrecy.
- Encryption transforms data so only holders of the correct key can read it. It is reversible only with the key, and its job is confidentiality.
- Hashing produces an irreversible fixed-size digest to verify integrity or store passwords. Its job is verification.
| Encoding | Encryption | Hashing | |
|---|---|---|---|
| Reversible? | Yes, by anyone | Yes, with key | No |
| Needs a key | No | Yes | No |
| Provides secrecy | No | Yes | N/A |
| Purpose | Format/transport | Confidentiality | Verify/integrity |
Why does confusing them cause breaches?#
Because encoding looks scrambled. Base64 output is unreadable to a human, so it is tempting to believe it hides something. It hides nothing — decoding is a one-line operation. Storing a “secret” as Base64, or calling a token “encrypted” when it is merely encoded, leaves data fully exposed while feeling safe. That false confidence is the danger.
For the security pair, see hashing vs encryption and symmetric vs asymmetric encryption. More at the Security Fundamentals hub.
Frequently asked questions#
Is Base64 encryption?
No. Base64 is encoding — a reversible representation with no key and no secrecy. Anyone can decode it instantly. Treating Base64 (or URL encoding, or hex) as if it protects data is a classic mistake; it provides zero confidentiality. Encoding changes format, not security.
When should you use each one?
Use encoding to safely represent data for transport or display. Use encryption to keep data confidential from anyone without the key. Use hashing to verify integrity or store passwords without keeping the original. Choosing the wrong one — like encoding where encryption is needed — creates a false sense of safety.