Encoding vs Hashing vs Encryption
Base64, SHA-256 and AES side by side: purpose, reversibility, keys and when to use each.
By the TurantTools Dev team · Updated October 27, 2026 · 2 min read
Base64, SHA-256 and AES all turn text into something unreadable, so they're often mixed up. They do completely different jobs.
| Encoding (Base64) | Hashing (SHA-256) | Encryption (AES) | |
|---|---|---|---|
| Purpose | Carry bytes as text | Fingerprint data | Keep data secret |
| Reversible? | Yes, by anyone | No | Yes, with the key |
| Needs a key? | No | No (HMAC uses one) | Yes |
| Use it for | Email attachments, data URIs, JWT parts | Checksums, integrity, password storage (slow hashes) | Stored secrets, messages, backups |
The classic mistake
"api-key-123" in Base64 is YXBpLWtleS0xMjM=. That looks scrambled but isn't protected at all: anyone can decode it in a second. HTTP Basic auth and Kubernetes secrets are Base64 too, which is why they need TLS and access control around them.