Hashing vs encoding vs encryption: a guide to the Hash & Encode Toolkit

Three words are constantly mixed up by beginners and by plenty of working developers: encoding, hashing and encryption. They look similar because each takes some data and produces different-looking data. But they solve different problems, and using the wrong one is a classic source of security bugs. The free Hash & Encode Toolkit offers SHA-1, SHA-256 and SHA-512 hashes and Base16, Base32 and Base64 encoding and decoding, all in your browser. This guide explains what each of them is, shows real outputs, and tells you when to use which.

The three ideas in one table

	Encoding	Hashing	Encryption
Purpose	Change the format so data can travel or be stored	Make a fixed-size fingerprint of data	Keep data secret from people without a key
Reversible?	Yes, by anyone	No, it is one-way	Yes, but only with the key
Needs a secret?	No	No	Yes
Example	Base64	SHA-256	AES
Is it security?	No	Sometimes (integrity, not secrecy)	Yes

If you remember one thing, remember this: Base64 is not protection. It only changes how bytes are written. Anyone can reverse it in a second.

Encoding: changing the format

Computers store everything as bytes, but some channels only carry text: email bodies, JSON strings, URLs, HTML attributes. Encoding turns arbitrary bytes into a safe set of characters so they can pass through such a channel and be turned back later.

Base64

Base64 uses 64 characters (letters, digits, plus and slash) and groups the input three bytes at a time into four characters. Because of that, the output is about a third larger than the input. When the input length is not a multiple of three, the output is padded with = signs.

You can check this yourself in the toolkit or on the command line. The text hello becomes:

aGVsbG8=

and Hello, World! becomes:

SGVsbG8sIFdvcmxkIQ==

Typical uses: embedding a small image directly in a web page as a data URL, sending binary attachments in email, and carrying binary values inside JSON.

Base32

Base32 uses 32 characters (uppercase letters A to Z and digits 2 to 7). It is longer than Base64 for the same data, but it avoids characters that are easy to confuse and it is case-insensitive, which makes it a good choice for values people may read aloud or type by hand. The text hello in Base32 is:

NBSWY3DP

Base16 (hexadecimal)

Base16 writes each byte as two hexadecimal digits. It is the least compact, doubling the size, but it is easy to read and to compare. The text hello is:

68656c6c6f

You will see hex when looking at colours, memory dumps, checksums and byte-level debugging.

Encoding and non-English text

Encodings work on bytes, not on letters. The text héllo is stored in UTF-8 as six bytes, because é takes two, so its Base64 form is different from that of hello. The Base64 of the UTF-8 bytes is aMOpbGxv. When you decode Base64 back to text, the tool and the system you are talking to have to agree that the bytes are UTF-8. A mismatch is the usual cause of garbled characters.

Hashing: a fingerprint, not a lock

A hash function takes input of any length and produces a fixed-length output, called a hash or digest. A good cryptographic hash has these properties:

• Deterministic. The same input always gives the same output.
• One-way. You cannot work backwards from the hash to the input.
• Avalanche effect. Changing a single character changes the output completely.
• Collision resistant. It should be impractical to find two different inputs with the same hash.

The SHA-256 hash of the text hello is:

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

It is always 64 hexadecimal characters, whether the input is one letter or a whole film. SHA-1 produces 40 characters and SHA-512 produces 128.

What hashes are good for

• Checking a download. A website publishes the SHA-256 of a file. You hash your copy and compare. If they match, the file was not changed or corrupted on the way.
• Detecting changes. Hash two versions of a document; if the hashes differ, the content differs.
• Identifying content. Systems use hashes as keys for cached files because identical content gives an identical hash.
• Part of larger systems. Digital signatures and message authentication codes are built on top of hashes.

What hashes are not for

Do not store passwords with a plain SHA-256. A fast hash is the wrong tool, because an attacker can test billions of guesses per second against a stolen list. Password storage needs a deliberately slow, salted password hashing algorithm such as bcrypt, scrypt or Argon2, provided by your language or framework. If you use PHP, the password hashing lesson shows the safe way.

Do not treat SHA-1 as safe for security. Practical collisions for SHA-1 have been demonstrated, so it should not be used where an attacker could exploit a collision, such as signatures. It is still seen in older systems and in non-security uses. Prefer SHA-256 or SHA-512 for anything new.

A hash is not encryption. You cannot get the original text back from it. If you need to get the data back, you need encryption, not hashing.

Using the toolkit

1. Open the Hash & Encode Toolkit.
2. Choose an operation: Base64, Base32, Base16, or one of the SHA hashes.
3. For the encodings, pick Encode or Decode.
4. Type or paste your text. The result appears below, and you can copy it.

Some worked uses:

• Decode a string you found in a config file or an API response. If it ends with = and uses letters, digits, + and /, try Base64 decode.
• Check that two pieces of text are identical. Hash both and compare the 64 characters. It is easier than comparing long text by eye.
• See the effect of a tiny change. Hash hello, then Hello. The two results share nothing, which shows the avalanche effect.
• Prepare a value for a place that only accepts text. Encode it, then decode it at the other end.

Common mistakes

Calling Base64 "encryption". It hides nothing. If a document says a secret is "encrypted with Base64", treat the secret as exposed.

Hashing with trailing spaces or line endings by accident. The hash of hello and hello (with a space) differ, and so do the hashes of text with different line endings. When two hashes should match but do not, look for invisible differences. The Invisible Character Cleaner finds hidden characters in pasted text.

Mixing up hex and Base64. Both are text representations of bytes, but they are not interchangeable. A SHA-256 digest can be written as 64 hex characters or as 44 Base64 characters. Make sure both sides use the same form.

Putting Base64 straight into a URL. Standard Base64 includes + and /, which have special meanings in addresses. A URL-safe variant swaps them for - and _. When you must put a value in a link, percent-encode it with the URL Encoder & Decoder.

Pasting secrets into online tools. The toolkit runs in your browser, but as a habit, do not paste live passwords, private keys or tokens into any website. Use test data to learn, and keep real secrets in a password manager or a command-line tool on your own machine.

Related tools

When you need a strong random value to hash or encode, the Password Generator uses your browser's cryptographic random source, and the UUID Generator makes unique identifiers. To work with structured data before encoding it, format it with the JSON Formatter.

Quick answers

Can I decode a SHA-256 hash? No. Online "hash decoders" only look up common inputs in tables of precomputed hashes. They cannot reverse the function.

Which SHA should I choose? Use SHA-256 for most things. SHA-512 gives a longer digest and is sometimes faster on 64-bit machines. Avoid SHA-1 for anything security related.

Why is my Base64 output longer than the input? Every 3 bytes become 4 characters, plus possible padding, so it is about a third larger.

Is encoding the same as compression? No. Compression makes data smaller. Base64 and hex make it bigger.