01 The one-sentence difference
Everything in this lesson comes down to a single question: can you get the original back, and what do you need in order to do it?
| Purpose | Reversible? | Needs a key? | |
|---|---|---|---|
| Encoding | Compatibility, safe transport | Yes, by anyone | No |
| Hashing | Verification, fingerprinting | Never, by design | No |
| Encryption | Confidentiality | Yes, but only with the key | Yes |
Encoding is a costume. Hashing is a fingerprint. Encryption is a safe. Only one of the three protects a secret, and it is the only one with a key.
02 Encoding: a costume, not a lock
Encoding changes how data is written so that some system can carry it safely. Email could not originally handle raw binary attachments, so we invented ways to write binary using only safe characters.
There is no secret involved. The method is public, and reversing it takes one command. You already did this in lesson 00.1 with hex.
The three you will meet constantly
- Hex writes each byte as two characters from 0 to f. Used in memory dumps, hashes and packet captures.
- Base64 packs data using letters, digits, plus and slash. Used in email attachments, web tokens and, very often, by malware hiding a payload.
- URL encoding replaces unsafe characters with a percent sign and a hex number, so a space becomes
%20. Attackers use it to sneak past filters that only check for the plain version.
Spotting base64 on sight
This is a genuinely useful reflex. Base64 looks like a long run of mixed-case letters and digits, its length is always a multiple of four, and it very often ends with one or two equals signs used as padding.
Try it. Type in the top box to encode, paste into the bottom box to decode.
Check yourself
You find cG93ZXJzaGVsbCAtZW5j inside a suspicious file. What is it, and what should you do?
powershell -enc, the start of a genuinely common malware technique. Decoding is free and instant, which is exactly why encoding is not security.03 Hashing: a one-way fingerprint
A hash function takes any input, of any size, and produces a fixed-length string. Feed it one word or an entire film, and the output is the same length.
The essential property is that it only goes one way. You cannot run a hash backwards to recover the input. It is not that it is difficult, it is that the information is genuinely gone, the same way you cannot un-blend a smoothie.
one direction only, and that is the entire point
Two properties that make it useful
- The same input always gives the same output. This is what makes a hash a reliable fingerprint.
- Changing one character changes everything. Alter a single letter and the output looks completely unrelated. This is called the avalanche effect, and it means you cannot tell "close" from "wildly wrong".
What hashes are actually for
- Storing passwords. A well-built site never stores your password. It stores the hash. When you log in, it hashes what you typed and compares. If the database leaks, the attacker gets fingerprints rather than passwords.
- Proving a file is unchanged. Download something, hash it, compare against the published hash. A mismatch means the file was altered in transit.
- Identifying malware. Every known malicious file has a known hash. Defenders match against huge shared lists of them.
You cannot reverse a hash. You can guess. An attacker hashes millions of common passwords and looks for a match, which is called a dictionary attack. It works because people choose predictable passwords, not because the hash broke. This is what you will do in Phase 02.6.
Defences are salting, which adds random text to each password so identical passwords get different hashes, and using deliberately slow algorithms like bcrypt or argon2 that make mass guessing expensive.
MD5 and SHA-1 are broken and must never be used for security. You will still meet them constantly in old systems and in training exercises. Recognising them as obsolete is itself a finding worth reporting. Use SHA-256 for integrity, and bcrypt or argon2 for passwords.
Check yourself
A website emails you your forgotten password in plain text. What does that prove?
Paste or pick a hash and see how its shape gives away the algorithm.
04 Encryption: a safe with a key
Encryption scrambles data so that only someone holding the right key can unscramble it. Unlike hashing it is meant to be reversed, and unlike encoding it cannot be reversed by just anyone.
Two families
Symmetric encryption uses one shared key for both locking and unlocking. It is fast, and it protects your disk and most bulk data. The standard is AES. Its problem is obvious: both sides need the same key, so how do you deliver it safely to a stranger?
Asymmetric encryption solves that with a clever trick: two mathematically linked keys. Your public key can be handed to the world and is used to lock. Your private key stays secret and is the only thing that unlocks.
This is what makes the padlock in your browser possible. Your Mac and the website have never met, yet they establish a shared secret over a network anyone can watch. That handshake is TLS, and it is why HTTPS works.
Asymmetric encryption is slow, so real systems use it only to safely agree on a temporary symmetric key. After that, the fast symmetric encryption carries the actual conversation. Every HTTPS page you load does this, thousands of times a day.
Check yourself
You want someone to send you a confidential file. Which key do you give them?
05 Telling them apart at a glance
You will constantly find unknown strings in files, databases and network traffic. Here is how to identify them fast.
| What you see | Probably | Next move |
|---|---|---|
| Letters, digits, ends with = | Base64 | Decode it |
| Only 0-9 and a-f, 32 chars | MD5 hash | Look it up or crack it |
| Only 0-9 and a-f, 64 chars | SHA-256 hash | Look it up or crack it |
| Starts with $2b$ | bcrypt hash | Slow to crack, that is deliberate |
| %20 and %2F scattered about | URL encoding | Decode it |
| Truly random bytes, no pattern | Encrypted | You need the key, cracking is not realistic |
Hashes are always a fixed length, no matter the input. So 32 hex characters means MD5 and 64 means SHA-256, essentially every time. Encoded data varies in length with its input. Encrypted data looks like noise. Count the characters first.
06 Do it on your real machine
Hash the same word twice and confirm you get an identical result:
echo -n "password123" | shasum -a 256 echo -n "password123" | shasum -a 256
Now change one character and watch the avalanche effect destroy any resemblance:
echo -n "password124" | shasum -a 256
Encode to base64, then decode it back:
echo -n "Logic beats luck" | base64 echo "TG9naWMgYmVhdHMgbHVjaw==" | base64 -d
Compare the length of two different hash types:
echo -n "test" | md5 echo -n "test" | shasum -a 256
Your checklist
- Can state the costume, fingerprint, safe distinction from memory
- Recognised base64 by its shape and decoded it
- Saw that the same input always produces the same hash
- Saw the avalanche effect from changing one character
- Can explain why a site emailing your password is a red flag
- Know which key you hand out and which you never share
07 Final check
Question 1 of 3
Which of these provides no confidentiality whatsoever?
Question 2 of 3
A database leak shows every user with the identical password has the identical hash. What is missing?
Question 3 of 3
You find a 64-character string of only digits and the letters a to f. What is it most likely?
Encoding is a costume anyone can remove. Hashing is a one-way fingerprint, defended with salting and slow algorithms. Encryption is a safe, and the key is what separates it from the other two. You can now identify an unknown string by its shape and length, which is a skill you will use in every phase ahead.
✓ Key takeaways
The things from this lesson worth carrying into the next one. If you remember nothing else, remember these.
★ Carry these forward
- Encoding is a costume, reversible by anyone with no key. Hashing is a one-way fingerprint, never reversible. Encryption is a safe, reversible only with the key.
- Random text added to each password before hashing, so identical passwords produce different hashes. Without it, cracking one hash cracks every account sharing it.
- The public key is given away freely and does the locking. The private key stays secret and is the only thing that unlocks. Sharing it collapses the system.
⚑ Keep going
You have read it and tried it in the lesson. Now cement it. These three do more for retention than re-reading ever will.