Web Security: Encoding and Hashing Guide
Encoding, hashing, and encryption are three fundamentally different operations that developers frequently confuse. Understanding the difference is critical for building secure applications.
The Three Operations
Encoding — Reversible Format Conversion
Encoding transforms data from one format to another for compatibility, not security. Anyone can decode encoded data without a key.
- Base64 — Binary-to-text encoding for embedding images, transmitting binary data.
- URL Encoding — Percent-encoding for safe URL characters.
- HTML Entities — Character encoding to prevent markup interpretation.
Important: Base64 is NOT encryption. Learn why.
Hashing — One-Way Fingerprint
Hashing produces a fixed-size “fingerprint” from any input. It cannot be reversed.
- SHA-256 — Data integrity verification, checksums.
- bcrypt — Password storage (with salt and key stretching).
Generate hashes instantly with our Hash Generator.
Encryption — Reversible with a Key
Encryption transforms data into an unreadable format that can only be decoded with the correct key. It provides confidentiality.
- AES — Symmetric encryption (same key encrypts and decrypts).
- RSA — Asymmetric encryption (public key encrypts, private key decrypts).
Quick Comparison
| Encoding | Hashing | Encryption | |
|---|---|---|---|
| Reversible? | ✅ Yes (no key needed) | ❌ No (one-way) | ✅ Yes (with key) |
| Purpose | Format compatibility | Integrity verification | Confidentiality |
| Security? | ❌ None | ⚠️ Partial | ✅ Full |
| Example | Base64, URL encode | SHA-256, bcrypt | AES, RSA |
When to Use What
| Scenario | Use | Tool |
|---|---|---|
| Embed image in CSS | Base64 encoding | Base64 Encoder |
| Store user passwords | bcrypt hashing | Learn bcrypt vs SHA |
| Verify file integrity | SHA-256 hash | Hash Generator |
| Prevent XSS attacks | HTML entity encoding | HTML Entity Encoder |
| Inspect auth tokens | JWT decoding | JWT Decoder |
| Build URL query strings | URL encoding | URL Encoder |
Common Mistakes
Mistake 1: Using Base64 for “Security”
Base64 only changes the format. It provides zero confidentiality. Read more: Base64 is Not Encryption.
Mistake 2: Using SHA-256 for Passwords
SHA-256 is fast — too fast for password storage. An attacker can compute billions of SHA-256 hashes per second. Use bcrypt or Argon2 instead. Read more: bcrypt vs SHA-256.
Mistake 3: Skipping HTML Entity Encoding
Displaying user input without encoding HTML entities enables XSS attacks. Read more: XSS Prevention with HTML Entity Encoding.