Hashing vs Encryption vs Encoding

Three different jobs

Mixing up the columns is where security bugs come from.

Encoding

Encoding transforms data into another representation for transport or storage — and back. It provides no security.

• Base64 — binary as text.
• URL encoding — safe characters for URLs.

Try the Base64 encoder/decoder. Never use encoding to protect secrets.

Encryption

Encryption scrambles data so only someone with the key can read it. It is reversible by design.

• Symmetric (AES) — one shared key, fast.
• Asymmetric (RSA, ECC) — public/private key pair.

Use it for confidentiality: data at rest, HTTPS, messaging. Manage keys carefully; encryption is only as strong as key handling.

Hashing

Hashing produces a fixed-length digest from any input. It is one-way — you cannot reverse it.

• Integrity — detect changes.
• Signatures — sign a digest, not the data.
• Password storage — with a salt and slow algorithm.

Compute digests with the SHA-256 generator and keyed hashes with the HMAC generator.

The password trap

Storing passwords with fast hashes (MD5, SHA-256) is a mistake: attackers can try billions of guesses per second. Correct approach:

1. Salt each password uniquely.
2. Use a deliberately slow algorithm — bcrypt, scrypt or Argon2.
3. Never reuse the same hash across users.

HMAC: hashing with a key

HMAC combines a hash with a secret key to authenticate a message. It verifies both integrity and authenticity — used in webhooks, API signatures and JWTs.

Quick decision guide

• Needed back, no secrecy → encoding.
• Needed back, secrecy required → encryption.
• Never needed back, verify integrity → hashing.

Use the right tool

All three run locally in your browser with these free tools — your data never leaves your device.