Encoding vs encryption vs hashing: telling base64, AES, and SHA-256 apart

Three different jobs

Encoding changes representation so data survives a channel: base64, hex, URL encoding. Anyone can reverse it; there is no key. Encryption hides data from anyone without the key: AES, ChaCha20, RSA-OAEP. Hashing produces a fixed-size fingerprint that cannot be reversed: SHA-256, BLAKE2, and, for passwords, Argon2 or bcrypt.

Mixing these up causes real incidents, such as “encrypting” credentials with base64 in a configuration file.

Recognizing outputs

Base64 uses A–Z, a–z, 0–9, + and / (or - and _ for base64url) and often ends with = padding. Hex uses only 0–9 and a–f, two characters per byte. A SHA-256 hex digest is always 64 hex characters. bcrypt hashes start with $2b$ and Argon2 with $argon2id$. Ciphertext usually looks like random bytes and is often then base64-encoded for transport.

Lab: identify and reverse

For each value below, decide whether it is encoded, hashed, or encrypted, and reverse it if possible. Use the shell or CyberChef locally.

echo 'aGFja2JsdWUgbGFi' | base64 -d                 # encoded
echo '6861636b626c7565' | xxd -r -p; echo          # hex encoded
echo 'hackblue%20lab%3F' | python3 -c 'import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read().strip()))'
printf 'hackblue' | sha256sum                      # 64 hex chars, one-way
echo 'U2FsdGVkX19hbGFi' | base64 -d | head -c 8; echo   # 'Salted__' = openssl enc output

In reviews and investigations

In code review, flag base64 used as protection. In investigations, decode layers patiently: attackers and legitimate tools both stack base64, compression, and XOR. Recognizing a format is the first step to deciding whether you can read it or need a key.