Encoding vs Encryption vs Hashing: A Developer's Guide
Encoding, encryption, and hashing get used interchangeably in conversation, but they solve completely different problems — and mixing them up causes real security bugs, like "encrypting" a password with Base64. This guide draws the line between the three, end to end.
Prefer a focused read? Jump to What Is Base64 Encoding? or Character Encoding: ASCII, Unicode & UTF-8 for encoding, MD5, SHA-1 & SHA-256 for hashing, or Base64 Is Not Encryption for the most common mix-up.
The one-line distinction
- Encoding transforms data into another format so it can be stored or transmitted safely. It is reversible by anyone — there is no secret. Goal: compatibility.
- Encryption scrambles data so only someone with the key can read it. Reversible only with the key. Goal: confidentiality.
- Hashing maps data to a fixed-size fingerprint. It is one-way — you cannot get the original back. Goal: integrity and verification.
If you remember one thing: encoding has no secret, encryption has a key, and hashing has no way back.
Encoding — for compatibility
Encoding converts data into a format that some system can handle. Base64 turns binary into text so it survives a JSON field or a data URI; URL encoding (percent-encoding) escapes characters that would otherwise break a URL; character encodings like UTF-8 map text to the bytes a computer stores.
None of this is secret. Anyone who sees the encoded value can decode it — that is the point. Encoding protects data from being corrupted or misinterpreted, never from being read.
"Hi!" -> Base64 -> "SGkh" (decode is trivial: "SGkh" -> "Hi!")
Learn more in What Is Base64 Encoding?, URL Encoding Explained, and Character Encoding: ASCII, Unicode & UTF-8.
Encryption — for confidentiality
Encryption uses an algorithm plus a key to turn readable data (plaintext) into unreadable data (ciphertext). Without the key, the ciphertext is useless; with it, you recover the original exactly. Two broad kinds:
- Symmetric (e.g. AES) — the same key encrypts and decrypts. Fast; the challenge is sharing the key securely.
- Asymmetric (e.g. RSA) — a public key encrypts, a private key decrypts. This is what secures TLS/HTTPS and signatures.
Encryption is the only one of the three designed to keep data secret from someone who can see it. If your goal is "nobody but the intended reader can see this," you need encryption — not encoding.
Hashing — for integrity
A hash function takes any input and produces a fixed-size digest. The same input always yields the same digest, but you cannot reverse it, and a good hash makes collisions (two inputs, same digest) practically impossible.
That one-way property is exactly why hashing is used to verify without storing the original:
- Password storage — store the hash, not the password. On login, hash the attempt and compare. (Use a slow, salted algorithm like bcrypt or Argon2 — never plain MD5/SHA for passwords.)
- Integrity checks — a file's checksum tells you it wasn't altered.
- Deduplication and lookups — a digest is a compact fingerprint.
See MD5, SHA-1 & SHA-256: Hashing Explained for how the common algorithms differ.
Which one do I need?
| Goal | Use |
|---|---|
| Move binary safely through text (JSON, data URI, email) | Encoding (Base64) |
| Put data in a URL safely | Encoding (URL/percent) |
| Keep data secret from anyone without a key | Encryption |
| Store passwords, verify integrity, fingerprint data | Hashing |
A quick tell: if you need to get the exact original back, you want encoding or encryption. If you only ever need to check a match, you want hashing.
Common mistakes
- Treating Base64 as security. Base64 hides nothing — see Base64 Is Not Encryption.
- Hashing to keep something secret. Hashing is one-way; it can't be "decoded" by you either. If you need the data back, that's encryption.
- Using MD5 or SHA-256 for passwords. They're fast, which helps attackers. Use bcrypt/scrypt/Argon2 with a salt.
- Assuming a JWT is encrypted. A standard JWT is Base64url-encoded and signed — its payload is readable by anyone. See How to Decode a JWT.
Related
Put it into practice with the Base64 Encoder/Decoder, URL Encoder/Decoder, and Hash Generator — all client-side, nothing uploaded.
Try it
Encode or decode a value and watch it round-trip in your browser — the fastest way to see what encoding does (and doesn't) do.