Hashing vs Encryption vs Encoding: 3 Things Every Dev Confuses
Encoding, encryption, and hashing get used like synonyms but do three different jobs. The tell is whether you need the original back, and for whom: encoding is reversible by anyone (no key), encryption is reversible only with a key, and hashing is not reversible at all.
Encoding (Base64, UTF-8, URL encoding) just reformats data so it travels safely — reversible by anyone, no key, no protection. Encryption (AES, RSA) scrambles data so only the key holder can read it back — reversible only with the key, which is what gives you confidentiality. Hashing (SHA-256) presses data into a fixed-size fingerprint that is one-way by design — you verify by comparing hashes, which is why passwords should be hashed (with a slow, salted algorithm like bcrypt or Argon2), never encrypted.
Transcript
Encoding, encryption, hashing — developers use them like synonyms. But think of the mail: a postcard, a locked strongbox, and a wax seal are not the same thing. All three transform your message, but each answers a different question — who can read it, and can you ever get it back? Let's open the mailbag.
Encoding is a POSTCARD. You rewrite your data into a form the system can carry — Base64, UTF-8, URL-encoding — like block capitals a sorting machine can read. But a postcard is open: anyone who handles it reads it, and anyone can decode it right back. No key, no secret. Encoding is formatting, not protection — Base64 hides nothing.
Encryption is a locked STRONGBOX. You scramble the message so only someone with the KEY can open it — AES for a shared key, RSA for a key pair. That's confidentiality. Anyone can see the box, but without the key it's just noise. It's reversible — but only with the key. That's the whole line between it and a postcard.
Hashing is a WAX SEAL. You press the message into a fixed-size imprint — a digest like SHA-256 — and there's no melting it back. It's one-way, by design. The same letter always makes the same seal, so you VERIFY by comparing seals — did this file change? does this password match? — without ever storing the letter itself.
So one question sorts them: do you need the message back, and for whom? Everyone — encode. Only the keyholder — encrypt. Never, just prove a match — hash. That's why 'encrypting' passwords is a bug: a strongbox opens, so one stolen key spills them all. A wax seal can't be reversed — hash them, with a slow, salted hash.
Three jobs, not three synonyms. A postcard for format, a strongbox for secrecy, a wax seal for a fingerprint you can check but never undo. So next time you reach for one, ask the only question that matters: do you need to get the message back?