Data and secrets
Separate encoding, hashing, and encryption
Choose the correct operation by distinguishing representation, one-way fingerprints, and reversible protection with a key.
8 minute lesson
Base64 is not encryption. A hash is not a way to hide data you need to recover later.
Encoding changes representation. Hashing produces a fixed-size fingerprint and is designed to be one-way. Encryption protects confidentiality using a key and must also protect integrity. Pick the operation from the goal, not from a familiar function name.
A backup tool Base64-encodes customer records and labels the result encrypted. Anyone who downloads the file can decode it without a key.
Hashing the backup would prevent recovery, while encryption without integrity could allow silent changes. The correct operation follows the security goal we started with.
Classify a session token, file checksum, password record, and recoverable backup by goal and operation. Decode the encoded example, alter the protected example, and record which checks detect the change.
Lesson completed