What is the difference between encoding, encryption and hashing? Which one would you use to store passwords, to send a confidential file, and to put binary data in a URL?
Show the explanation
| Encoding | Encryption | Hashing | |
|---|---|---|---|
| Purpose | represent data in another format | keep data secret | produce a fixed-size fingerprint of data |
| Needs a key? | no | yes | no (keyed variants such as HMAC use one) |
| Reversible? | yes, by anyone | yes, but only with the right key | no, one-way by design |
| Output size | depends on the input | about the input size | fixed (SHA-256 is always 256 bits) |
| Examples | Base64, URL percent-encoding, UTF-8, hex | AES (symmetric), RSA or elliptic-curve schemes (asymmetric) | SHA-256, SHA-3, BLAKE2; for passwords: Argon2, scrypt, bcrypt |
Answers to the three cases
- Storing passwords → hashing, with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt. You never need the original password back. You only check whether a login attempt hashes to the same value.
- Sending a confidential file → encryption, for example over TLS, or encrypting the file with AES-GCM using a key shared securely, often through public-key cryptography.
- Binary data in a URL → encoding (Base64URL or percent-encoding). It provides no security: anyone can decode it.
Properties of a cryptographic hash
- Pre-image resistance: given a hash, you cannot find an input that produces it.
- Second pre-image resistance: given an input, you cannot find a different input with the same hash.
- Collision resistance: you cannot find any two inputs with the same hash. MD5 and SHA-1 fail this, so do not use them for security.
- Avalanche effect: changing one input bit changes about half of the output bits.
Common misconceptions to avoid
- "Base64 is encryption." It is not.
- "Hashing is encryption that can't be undone." They are different tools with different goals.
- "SHA-256 is fine for passwords." It is too fast, which makes guessing attacks cheap. Use a deliberately slow password hash.
- Integrity alone uses a hash or MAC. Proof of who sent something needs a digital signature, which signs a hash with a private key.
Original UniCircle question. Last reviewed 22 Oct 2026.