Security · 7 min read · 2026-10-26
Ask a room of developers to define the difference and hands wave. Yet the distinction is crisp: encoding converts data for TRANSPORT (anyone can reverse it), encryption converts data for SECRECY (only the key holder can reverse it), and hashing converts data for VERIFICATION (nobody reverses it, on purpose). Choosing the wrong one is not a style mistake - it is the difference between a password that is protected and a password that is merely decorated.
Base64, URL encoding and hex are encodings. They exist because some channels cannot carry certain characters - email attachments need Base64 because SMTP was born ASCII, URLs need percent-encoding because spaces and ampersands would break their structure. Encoding has NO key and NO secrecy: decoding is a public, deterministic operation. Storing a password as Base64 is the classic beginner mistake - it is identical to storing it in plaintext, with extra steps.
A hash function digests any input into a fixed-size fingerprint - SHA-256 always emits 32 bytes, whether you hash one word or a 4 GB file. The properties that matter: the same input always yields the same output, a tiny input change cascades into a completely different hash, and there is no practical way to run it backwards. That makes hashing perfect for verification: file checksums prove a download arrived intact, and password storage stores the hash (plus salt) instead of the password, verifying future logins by re-hashing and comparing.
Encryption is the only one of the three designed to be reversed - by the holder of the right key. Symmetric encryption (AES) uses one shared key for both directions: fast, common for files, disks and backups. Asymmetric encryption (RSA and friends) uses a public key to lock and a private key to unlock: slower, but it lets strangers send you secrets without ever sharing a key. When someone says a message is "end-to-end encrypted," they mean the sender encrypted it with a key only the recipient holds - the transport in between carries a locked box.
Encoding is a costume, encryption is a locked box, hashing is a fingerprint. Only one of them keeps a secret, and only one of them proves a file arrived whole.