Encryption vs encoding: they are different

August 4, 2026 · 13 min read

Teams say “we encrypt passwords in Base64” or “the token is encrypted” when the token is only JWT-encoded. Encoding transforms data for transport or storage format; anyone can reverse it. Encryption requires a secret key and is computationally infeasible to undo without that key.

Mixing terms causes real incidents: PII stored “encoded” in logs, compliance checkboxes marked for encryption that is only Base64, and developers who skip TLS because payloads are “encrypted” with a public algorithm.

Clear definitions

Encoding - reversible without secrets (Base64, hex, UTF-8).
Encryption - reversible only with the correct key (AES-GCM, RSA-OAEP).
Hashing - one-way (SHA-256, bcrypt for passwords).

Signing (HMAC, RSA signatures) is yet another category: proves authenticity, may not hide content.

Encoding (Base64 and friends)

Base64 makes binary safe for JSON and email. The algorithm is public; decoding takes microseconds. Encoding protects against transport glitches, not attackers. JWT payloads are Base64URL-encoded JSON - not encrypted unless you use JWE.

Secret: "admin"
Base64: YWRtaW4=
Anyone can decode → admin

Encryption (AES and keys)

Symmetric encryption (AES-GCM) uses a shared secret key. Asymmetric encryption (RSA, ECDH) uses key pairs. Ciphertext should be indistinguishable from random bytes without the key. Keys live in KMS, HSMs, or sealed environment variables - not in source control.

Always combine encryption with authentication (AEAD) or encrypt-then-MAC. Never use ECB mode for structured data.

Hashing is a third thing

Hashes verify integrity or store passwords; you cannot get the input back. SHA-256 of a file detects accidental corruption; bcrypt stores passwords. Do not call hashing “encryption,” and do not encrypt if you only need a fingerprint.

When product asks for “irreversible encryption,” they usually mean hashing.

Auditing your stack

Inventory fields labeled encrypted: confirm algorithm, key management, and rotation. Replace “Base64 for security” with TLS in transit and real encryption or tokenization at rest for sensitive columns. Document for each field: public, internal, confidential, and the control applied.

Developer tools should label operations accurately - decode vs decrypt - so learning transfers to production decisions.

FAQ

Is Base64 weak encryption?: It is not encryption at all. It provides zero confidentiality against anyone who sees the string.
Are JWTs encrypted?: Standard JWTs are signed (JWS) or signed+encoded, not encrypted. JWE encrypts the payload.
When is encoding enough?: When you only need binary-safe text in JSON or email and data is not secret, or secrecy is handled elsewhere (TLS).
What should I use for secrets at rest?: Encrypt with AES-GCM via KMS, or use a vault. Hash passwords with bcrypt or Argon2.

Related: What is Base64 encoding?

Browse all tools