Encoding vs Encryption vs Hashing: The Difference Every Engineer Should Understand

Encoding, Encryption, and Hashing: Three Concepts Developers Confuse All the Time

While working on post-quantum cryptography (PQC) projects for digital identity, KYC, and payment systems, I was surprised by how often people use the terms encoding, encryption, and hashing interchangeably.

They all transform data.

They all make information look different from its original form.

And they all appear throughout modern software systems.

But they solve completely different problems.

Let’s use a banking example.

Suppose we have the following payment instruction:

Pay USD 10,000 from Account A to Account B

There are three very different things we can do with this information.

Three different transformations. Three completely different purposes.

Encoding: Making Data Transportable

Encoding is not security.

Its purpose is simply to convert data into a format that can be safely transmitted or stored.

For example, a payment message may be encoded using Base64:

UGF5IFVTRCAxMCwwMDAgZnJvbSBBY2NvdW50IEEgdG8gQWNjb3VudCBC

The message now looks unreadable to most humans.

But it is not protected.

Anyone can decode it back to:

Pay USD 10,000 from Account A to Account B

No secret key is required.

Encoding is used everywhere:

• JWT tokens
• Email attachments
• Binary files over HTTP
• ISO 20022 payload transport

Encoding answers the question:

How do I make data easier to transmit or store?

Not: How do I secure it?

Encoding is designed for transport and compatibility, not security.

Encryption: Keeping Information Secret

Encryption protects confidentiality.

Unlike encoding, encryption requires a key.

A payment message might be encrypted using AES:

8F2A7C9D4B3E...

Without the encryption key, the original message should remain unreadable.

Encryption is what protects:

• Online banking sessions
• Payment instructions
• Customer data
• API communications
• Digital identities

There are two major types of encryption.

Symmetric Encryption (AES)

AES is the most widely used encryption algorithm today.

The same key is used to:

• encrypt data
• decrypt data

Example:

Message
   ↓
AES Encryption + Secret Key
   ↓
Cipher Text
   ↓
AES Decryption + Same Secret Key
   ↓
Original Message

AES is fast and efficient.

That is why it is commonly used for:

• TLS sessions
• database encryption
• file encryption
• payment systems

AES uses the same key for encryption and decryption. This is how most data is protected in transit and at rest.

Asymmetric Encryption (RSA)

RSA uses two keys:

• Public Key
• Private Key

The public key encrypts.

The private key decrypts.

Message
   ↓
Encrypt with Public Key
   ↓
Cipher Text
   ↓
Decrypt with Private Key
   ↓
Original Message

RSA solved a major problem:

How do two parties communicate securely without first sharing a secre key?

For decades RSA became the foundation of:

• HTTPS
• PKI
• Digital Certificates
• Secure Email

The challenge is that RSA is vulnerable to sufficiently powerful quantum computers, which is one of the reasons post-quantum cryptography has become so important.

RSA solved the key-sharing problem by introducing public and private keys.

Hashing: Verifying Without Revealing

Hashing solves a different problem.

A hash function transforms data into a fixed-length fingerprint.

Example:

Pay USD 10,000 from Account A to Account B

might become:

7d9f6e5b89d2a3f8...

A good hash function is designed to be one-way.

You can generate the hash from the original message.

But you cannot realistically recover the original message from the hash.

Hashing is commonly used for:

• Password storage
• Digital signatures
• Blockchain transactions
• File integrity verification

Hashing answers the question: Has this data changed?

Why Salt Matters

A common mistake is storing hashes directly.

Consider two users who both use the same password:

Welcome123!

Without salt, both users produce exactly the same hash.

An attacker immediately learns they share the same password.

To prevent this, systems add a random value called a salt.

Example:

User 1:
Welcome123! + X7A9

User 2:
Welcome123! + M2K4

Now both users generate completely different hashes.

Salt does not make hashing stronger.

It makes large-scale attacks significantly harder.

Modern password storage should always use:

• salt
• strong hashing algorithms
• key stretching algorithms such as bcrypt, Argon2, or PBKDF2

A salt ensures two identical passwords generate different hashes, making attacks significantly harder.

Where This Appeared in My PQC Project

While working on post-quantum identity and KYC systems, all three concepts appeared repeatedly.

Identity credentials were encoded so they could be exchanged between systems.

Sensitive customer information was encrypted to protect confidentiality.

Digital signatures relied on hashing to verify that credentials had not been modified.

As we introduced post-quantum cryptography, the biggest changes affected algorithms such as RSA and ECC.

Encoding remained unchanged.

Hashing largely remained unchanged.

But public-key encryption and digital signatures required migration to quantum-resistant algorithms.

This is an important distinction because many discussions about quantum threats focus on “encryption” generally, when the reality is much more specific.

The biggest impact of quantum computing is on public-key cryptography, not on Base64 encoding or salted password hashes.

A modern banking application typically uses encoding, encryption, hashing, and digital signatures simultaneously.

Quantum computing poses the greatest threat to public-key cryptography such as RSA and ECC. Symmetric encryption like AES and modern hash functions remain much more resilient, although larger key sizes (such as AES-256) are recommended in a post-quantum world. Encoding techniques such as Base64 are unaffected.

The Simple Test

Whenever you encounter transformed data, ask three questions:

Can anyone reverse it?

If yes, it is probably encoding.

Can only someone with the correct key reverse it?

It is encryption.

Can nobody realistically reverse it?

It is hashing.

That simple test eliminates most confusion.

Final Thought

Encoding, encryption, and hashing often appear together inside the same application.

But they solve fundamentally different problems.

Encoding makes data transportable.

Encryption makes data secret.

Hashing makes data verifiable.

Understanding that distinction is one of the first steps toward understanding modern cybersecurity — and why post-quantum cryptography matters.

One of the most surprising things about post-quantum cryptography is that AES is not being replaced. Most migration effort focuses on replacing public-key algorithms such as RSA and ECC, while AES largely survives with larger key sizes.