"The password is hashed, so Base64." I read this in a pull request once. It's wrong. Not "technically not quite correct" wrong, but "this person doesn't understand three fundamental concepts" wrong. That's not a personal failing — the terms encoding, hashing, and encryption get mixed up constantly, even by people who should know better.

This article clears it up. In 10 minutes you'll know what each of these three concepts does, why they're fundamentally different, and when to use which. With bitcalc's Base64 Encoder and Hash Generator as your practical tools.

The essence — in three sentences

Encoding makes data transportable. It is reversible and not a security mechanism.
Hashing makes data comparable. It is irreversible (one-way function) and serves integrity.
Encryption makes data unreadable. It is reversible with a key and serves confidentiality.

Three words, three concepts, three completely different use cases. Mix them up and you build insecure systems. Understand them and you know instantly which tool you need.

Encoding: making data travel-ready

Encoding translates data from one format to another. The key sentence: encoding is not a secret. Anyone who knows the algorithm can reverse it. There is no key, no password, nothing.

The classic example is Base64. Binary data (an image, a PDF, an SSH key) is converted to an ASCII string that can survive in JSON, XML, emails, or URLs — anywhere only printable characters are allowed.

# Before (UTF-8):    Hello World!
# Base64:             SGVsbG8gV29ybGQh

# And back:
echo "SGVsbG8gV29ybGQh" | base64 -d
# → Hello World!

Other encoding methods: URL encoding (%20 for spaces), hex encoding, HTML entities (&). All the same principle: Format A → Format B → back to Format A. No secret, no security, just transport.

Anti-pattern "We encode passwords in Base64 so they're secure." Base64 is NOT password protection. Anyone can decode it in a millisecond. Treating Base64 as security means you don't understand encoding.

Hashing: the digital fingerprint

A hash function takes arbitrary data and produces a fixed-length string — the hash. Three properties make hashes special:

  1. Deterministic: Same input → same hash. Always.
  2. Irreversible: You cannot derive the input from the hash. It's a one-way street.
  3. Collision-resistant: Two different inputs should practically never produce the same hash.

What hashes are good for: password storage, integrity verification (file downloads), deduplication (Git uses SHA-1 to identify objects).

Why MD5 and SHA-1 are dead

MD5 used to be the standard. Today you generate an MD5 collision in seconds on a laptop. SHA-1 has the same problem. Both are cryptographically broken. For new projects: SHA-256 minimum. For passwords: argon2id, bcrypt, or scrypt — hash functions deliberately slow with salting built in.

Hash algorithms compared: MD5, SHA-1, SHA-256, SHA-512, bcrypt
From MD5 to bcrypt: which hash for what. MD5 and SHA-1 are cryptographically dead. SHA-256 is the minimum. bcrypt/argon2 are mandatory for passwords.

Encryption: making data invisible

Encryption makes data unreadable to unauthorized parties — but recoverable with the right key. That's the fundamental difference from hashing: a hash is a one-way street, encryption is a door with a key. Two families: symmetric (AES, ChaCha20 — one key, fast) and asymmetric (RSA, ECC — public/private key pair, solves key exchange). In practice, TLS combines both.

Encoding vs. Hashing vs. Encryption — comparison table
Three concepts, three fundamentally different tools.

Real-world mistakes

  1. "Base64-encrypted passwords." No. Base64 is encoding. Anyone can decode it.
  2. "MD5 hash for password storage." No. MD5 is too fast, no salt, known collisions. Cracked in minutes.
  3. "We hashed the config file." No. A hashed config can't be read back. Encrypt if you need it back.
Rule of thumb Need to read data again later? → Encryption (or Encoding for transport).
Only need to verify something is unchanged? → Hashing.
Need data in a different format? → Encoding.

The bitcalc tools

The Base64 Encoder/Decoder encodes and decodes live as you type. The Hash Generator supports MD5, SHA-1, SHA-256, and SHA-512. Both run entirely client-side.