All lessons T
Encoding & Escaping beginner 8 min

Tell Encoding, Escaping, Hashing, and Encryption Apart

Follow one string through common transformations so you know what can be decoded and what cannot.

Scenario

A teammate calls every unreadable string "encrypted," and the debugging session goes sideways from there. The three values below are actually three different transformations: hello%20world is URL escaping (reversible, mechanical), aGVsbG8gd29ybGQ= is Base64 encoding (reversible — the trailing = padding is the tell), and the 32-hex-character value is an MD5-style hash (one-way, no decoder exists). Encryption is a fourth thing entirely — reversible only with a key. Classifying the string correctly is what decides which tool can help at all.

Broken input

hello%20world
aGVsbG8gd29ybGQ=
64ec88ca00b268e5ba1a35678a1b5316

Goal

Use Base64 Encoder and its sibling decoders to sort the reversible values from the one-way digest, so nobody spends an afternoon trying to "decrypt" a hash.

Tool sequence

  1. Open Base64 Encoder.
  2. Decode aGVsbG8gd29ybGQ= — it cleanly yields hello world. Base64's alphabet (A-Za-z0-9+/ with = padding) made it the obvious first suspect.
  3. Run hello%20world through URL Encoder in decode mode — %20 is a percent-escaped space, another fully reversible transform.
  4. Try the hex string in either decoder: 32 hex characters with high randomness and no structure is a digest fingerprint. Nothing decodes it, because hashing throws the original away by design.
  5. To verify a hash you compare, not decode: hash the candidate input with SHA-256 Generator and check whether the digests match.

Checkpoint output

hello%20world                     → URL escaping   → decodes to "hello world"
aGVsbG8gd29ybGQ=                  → Base64         → decodes to "hello world"
64ec88ca00b268e5ba1a35678a1b5316  → hash digest    → one-way, compare only

Two of the three strings reverse into the same plaintext; the third is a fingerprint that can only be matched against a freshly computed digest.

Common mistakes

  • Calling Base64 encryption — it is a public, keyless representation; treating it as protection is a security bug, not just a naming one.
  • Trying to "decrypt" a hash instead of hashing a candidate value and comparing digests.
  • Decoding URL text twice, so a legitimate literal %2520 in the data collapses into a space.
  • Assuming a random-looking string is encrypted when length and alphabet (32/40/64 hex chars) usually identify it as MD5/SHA-1/SHA-256.

Related tools and lessons