HomeAll 48 Tools
Case ConversionUppercase to LowercaseTitle CaseSentence CasecamelCasesnake_casekebab-case
Text ToolsWord CounterCharacter CounterText CompareRemove Line BreaksSort LinesLorem Ipsum Generator
Developer ToolsBase64 Encode / DecodeJSON FormatterURL Encode / DecodeUUID GeneratorPassword GeneratorSHA Hash Generator
BlogAboutContactFAQsPrivacy Policy
Guide

Encoding vs Encryption vs Hashing

·7 min read

Encoding, encryption, and hashing get used interchangeably in conversation, and the confusion causes real damage. "We Base64 the password before storing it" is a sentence that has preceded more than one breach.

The three do genuinely different jobs.

PurposeReversible?Needs a key?
EncodingSafe transport of dataYes — by anyoneNo
EncryptionConfidentialityYes — with the keyYes
HashingIntegrity and verificationNo, by designNo

Encoding: making data safe to travel

Encoding transforms data into a different format so it survives systems that would otherwise mangle it. It provides no security whatsoever, because anyone can reverse it without any secret.

Base64 is the classic example: it represents binary data using 64 printable ASCII characters, so a file can travel inside an email or a JSON payload. URL encoding does the same job for characters that would otherwise break a web address. HTML entities stop angle brackets being read as markup.

The test is simple: if you can decode it on a public web page with no password, it is encoding. You can decode Base64 on this site in one click, which is exactly the point.

Base64 is not encryption

Worth stating flatly, because the mistake is common. Base64 obscures nothing — it looks scrambled to a human glancing at it, and that superficial unreadability is what fools people. Never Base64 a password, API key, or personal data believing it is protected. Note also that Base64 makes data about 33% larger, so it costs you bandwidth for zero security.

Encryption: keeping secrets

Encryption transforms data so that only someone holding the right key can read it. Reversal without the key is computationally infeasible.

  • Symmetric encryption (AES) uses the same key to encrypt and decrypt. Fast, and used for encrypting files, disks, and database fields.
  • Asymmetric encryption (RSA, elliptic curve) uses a public key to encrypt and a private key to decrypt. Slower, and used to establish trust — TLS, signed software, encrypted email.

Use encryption when you need to get the original data back but nobody else should. Credit card details, private messages, and files at rest.

Hashing: verifying without storing

A hash turns input of any size into a fixed-length fingerprint. The same input always produces the same output, changing one character produces a completely different result, and there is no way to work backwards.

Use hashing when you need to verify something rather than recover it: confirming a download arrived intact, detecting whether a file changed, or checking a password without ever storing the password itself.

SHA-256 is the sensible default for integrity work. MD5 and SHA-1 are both cryptographically broken and should only be used for non-security purposes like finding duplicate files or verifying legacy checksums.

"Decrypt this hash" is not a thing

Sites offering to "decrypt MD5" are running lookup tables of precomputed hashes for common inputs. They can reveal password123 instantly because someone already hashed it and stored the pair — not because they reversed the algorithm. Give them a random 30-character string and they have nothing.

This is also exactly why unsalted password hashes are worthless. If your password is anything ordinary, its hash is already in a public table.

The password storage rule

This is the most consequential place these concepts meet, so be precise about it:

  • Never encode passwords. Base64 offers nothing.
  • Never encrypt passwords. If you can decrypt them, so can an attacker who takes your key — and you have no legitimate reason to know a user's password.
  • Never hash passwords with SHA-256. It is designed to be fast, and a modern GPU computes billions of SHA-256 hashes per second, so stolen hashes fall to brute force quickly.
  • Hash passwords with bcrypt, scrypt, or Argon2. These are deliberately slow and salted, which is precisely what you want.

The salt matters as much as the algorithm. It is a unique random value added to each password before hashing, so two users with the same password get different hashes and precomputed tables become useless.

Where JWTs fit

JSON Web Tokens are a good illustration of all three ideas in one object. The header and payload are encoded with Base64URL — readable by anyone, which is why you must never put secrets in them. The signature is produced by hashing with a secret key, which proves the token was not modified. Nothing in a standard JWT is encrypted.

So a JWT guarantees integrity, not confidentiality. Decode one on our tool and you will see every claim in plain text — which is the point of the demonstration.

Choosing quickly

  • Need the data to survive a text-only channel? Encoding.
  • Need to get it back later but nobody else should read it? Encryption.
  • Need to check it matches without storing the original? Hashing.
  • Storing passwords? Hashing, with bcrypt or Argon2. Never the other two.

Try the tool

Convert text between 14 case formats instantly — free, no sign-up, and everything stays in your browser. Open the converter →

More guides

How Many Words Is a 5 Minute Speech?A 5 minute speech runs to roughly 650 words. Here is the full table for every common talk length, why the number is lower than people expect, and how to time yours properly.How Many Pages Is 1,000 Words?1,000 words is roughly 2 pages double spaced or 4 single spaced — but font, margins, and spacing move that number a lot. Here is the full table and what actually changes it.Character Limits for Every Social PlatformEvery platform has two limits: the hard cap, and the much shorter point where your text gets cut off with a "more" link. The second one is the one that matters.Title Capitalization: AP vs Chicago vs APAFour style guides, four sets of rules, and one question: does "over" get a capital? Here is what each guide actually says and how to stop arguing about it.Readability Scores Explained (and Their Limits)Readability formulas measure two things: sentence length and syllable count. That makes them genuinely useful and easy to game. Here is how to read the score honestly.How to Write URL Slugs That RankURLs are a small ranking factor but a large usability one. Here are the rules worth following, and the one mistake that genuinely costs you traffic.10 Common JSON Errors and How to Fix ThemAlmost every JSON parse failure comes down to one of ten mistakes. Here they are, with the reason each is invalid and the fix.Regex Cheat Sheet for BeginnersEverything you need to read and write ordinary regular expressions, in one page — plus the greedy matching trap that catches everybody.Strong Passwords: Length Beats ComplexityP@ssw0rd! is not a strong password. A 20-character random string of only lowercase letters is. Here is the maths behind why, and what actually matters.How to Fix Text You Accidentally Typed in All CapsYou wrote three paragraphs before noticing caps lock was on. Do not retype them — here are four ways to fix it in a couple of seconds.camelCase, snake_case, kebab-case: A Naming GuideFive naming conventions, and the rules for which one to reach for. Most of the choice is decided by your language — the rest is decided by what the name is.Title Case vs Sentence Case: Which Should You Use?Title case looks authoritative. Sentence case reads faster. Here is how to decide which one your headings should use — and the rules for getting each one right.