Cryptographic goals
Separate encoding, hashing, and encryption
Distinguish reversible representation, one-way digests, keyed authentication, and encryption so familiar APIs are not used for the wrong job.
8 minute lesson
Base64 changes how bytes are written. It provides no secrecy.
A cryptographic hash maps data to a fixed-size digest. A MAC authenticates data with a shared secret. Encryption makes plaintext recoverable only with a key and should normally include authentication. The goal chooses the primitive.
const encoded = Buffer.from('secret-key').toString('base64')
Buffer.from(encoded, 'base64').toString() //secret-keyAn application stores an API key as Base64 and labels the column encrypted_key. Anyone who reads the database can decode the value without a secret.
A plain hash also cannot authenticate a webhook because an attacker can change the body and calculate another hash. The operation must match the property you named first.
Classify Base64, SHA-256, HMAC, password hashing, and authenticated encryption by input, key use, reversibility, and security property. Save one small result from each available API. Then modify or decode every result and record what the operation does not protect.
Lesson completed