The Difference Between Hashing, Encryption, and Encoding

Hashing, encryption, and encoding are constantly confused. We define all three clearly, show when to use each, and clear up the most common mistakes.

#hashing#encryption#encoding#security#passwords

The Difference Between Hashing, Encryption, and Encoding

If you have ever heard someone say "I encrypted it with Base64," this article is for you. Hashing, encryption, and encoding are the three most commonly confused concepts in computing. All three transform data from one form into another, but their purposes are completely different. Using one in place of another leads to serious security holes.

Let's define each one clearly.

Encoding: Just a Representation

Encoding transforms data from one format into another. Its purpose is not security, but compatibility and portability. It puts data into a standard representation so that different systems can process it correctly.

The most important property of encoding: it requires no key and can be reversed by anyone. The algorithm is public. Anyone can decode a Base64 string in seconds.

Common examples:

Base64 — Used to carry binary data through text-based media (email, JSON, URLs).
URL encoding — Converts characters like spaces into %20.
ASCII / UTF-8 — Maps characters to numeric values.

For example, the Base64 representation of the word hello:

hello  →  aGVsbG8=

This output may look "encrypted," but it isn't. There is no key and no secrecy. To try it yourself, use our Base64 Encoder.

Golden rule: Never use encoding for security. Base64 doesn't hide data; it just writes it in a different alphabet.

Encryption: Reversible Confidentiality With a Key

Encryption transforms data into a form that only those with the correct key can read. Its purpose is confidentiality. Unlike encoding, recovering the original data without the key is practically impossible.

Encryption comes in two main types:

Symmetric Encryption

The same key is used to both encrypt and decrypt. It's fast and ideal for large volumes of data.

Example algorithms: AES, ChaCha20
Challenge: Delivering the key to the other party securely.

Asymmetric Encryption

A key pair is used: data is encrypted with a public key and decrypted with a private key. This solves the key-sharing problem.

Example algorithms: RSA, ECC
Uses: HTTPS/TLS, digital signatures, email encryption.

The critical point about encryption: it is reversible. With the correct key, the original data is recovered intact. That's exactly why encryption is not suitable for storing passwords — if the key is compromised, every password is exposed.

Hashing: A One-Way Fingerprint

Hashing transforms data of any size into a fixed-length, unique digest. Its most important property is being one-way: going from the digest back to the original data is mathematically infeasible.

The purposes of hashing:

Integrity — Checking whether a file or message has changed.
Password storage — Storing not the password itself, but its digest.

Properties of a good hash function:

The same input always produces the same output.
The smallest change in the input completely changes the output (the avalanche effect).
Two different inputs producing the same output (a collision) should be practically impossible.

If you want to see the SHA-256 digest of the word hello, try the SHA-256 Generator, and for older algorithms check out the MD5 Generator.

Why Are MD5 and SHA-1 Broken?

MD5 and SHA-1 are no longer considered secure. Researchers have managed to create two different inputs that produce the same digest (a collision). You may still use these algorithms for non-security purposes (such as a quick file integrity check), but never for passwords or signatures.

If you're wondering which algorithm a digest belongs to, the Hash Identifier tool helps you make an educated guess.

For Passwords: Salt, bcrypt, and Argon2

Hashing passwords with plain SHA-256 is still not enough. Two reasons:

Speed — Modern hardware can compute billions of SHA-256 hashes per second, making brute-force very fast.
Rainbow tables — Precomputed digest tables crack common passwords instantly.

The solution:

Salt — A random, unique value is added to each password. This way even identical passwords produce different digests, and rainbow tables become useless.
Slow algorithms — bcrypt, scrypt, and Argon2 are deliberately slow and have a tunable cost factor. This makes brute-force attacks economically infeasible.

To try the bcrypt digest of a password, use the Password Hasher. You can reach all related tools from the Security tools page.

Comparison Table

Property	Encoding	Encryption	Hashing
Purpose	Compatibility / portability	Confidentiality	Integrity / passwords
Reversible?	Yes (by anyone)	Yes (with a key)	No
Requires a key?	No	Yes	No
Output length	Variable	Variable	Fixed
Example	Base64, URL	AES, RSA	SHA-256, bcrypt

When Should You Use Which?

Want to carry data inside an email or JSON? → Encoding (Base64).
Want to keep data secret and read it back later? → Encryption (AES, RSA).
Want to store a password or verify file integrity? → Hashing (Argon2, bcrypt, SHA-256).

Common Mistakes

"I encrypted it with Base64." No — you just encoded it. Anyone can decode it in a second.
Encrypting passwords with AES. Passwords should never be read back; they should be hashed. Anything that can be read back can be stolen.
Hashing passwords with plain MD5/SHA-1. No salt, no slowness — easily cracked.
Thinking a hash is "encryption." A hash is irreversible; encryption is reversible.

Distinguishing these three concepts correctly is the foundation of modern security. In short: encoding is format, encryption is confidentiality, and hashing is a fingerprint.