File formats

Hashing vs Encryption vs Encoding And What Each Does

No key means no secret. If nothing had to be known to produce the result, nothing has to be known to undo it.

Robert Smith 5 September 2026 6 min read

Hashing, encryption and encoding are three different operations. Three things get described with the same language. Encoding, hashing and encryption are all called protecting a file. Only one of them stops anybody reading it. Knowing which is which takes a minute and it decides whether the thing you did was worth doing.

This matters most where files are handed over. A mailbox export, a set of documents for a legal request, an archive somebody will open in five years. Each needs a different one of the three. The wrong choice usually looks exactly like the right one.

Hashing, Encryption And Encoding Side by Side

Start with what each one is trying to achieve, because the mechanics follow from that.

	Encoding	Hashing	Encryption
Exists to	Survive a journey	Prove nothing changed	Keep content private
Needs a key	No	No	Yes
Reversible	Yes, by anyone	No, by anyone	Yes, with the key
Output size	Larger than the input	Fixed, whatever the input	About the same
Hides anything	No	Not the point	Yes
Example	base64	SHA-256	AES

The second row settles most arguments. No key means no secret. If nothing had to be known to produce the result, nothing has to be known to undo it or to produce it again, which is why base64 protects nothing at all.

Why Encoding Is the One People Mistake for Encryption

A base64 block looks like a secret. Long, random, unreadable. It is none of those things.

original    invoice attached

base64      aW52b2ljZSBhdHRhY2hlZA==
            decode it in any browser console

SHA-256     8f14e45fceea167a5a36ded...
            cannot be turned back at all

AES         a mess of bytes
            readable with the key, useless without

Every attachment you send arrives base64 encoded. No part of that is a security measure. It exists because mail transport carries text and an attachment is not text.

Anything describing base64 as encryption is wrong in a way worth catching. It turns up in vendor descriptions and occasionally in compliance answers. It means somebody believed a file was protected when the protection was a text conversion anybody can undo.

What Hashing Is Actually For

A hash answers one question. Is this the same file it was.

Run a file through and you get a fixed length value. Change one byte anywhere and the value changes completely, so comparing two hashes tells you whether two files are identical without comparing the files themselves.

What a Hash Proves

Two files are byte for byte identical
A download arrived whole
An archive has not been altered since
A file matches one somebody else holds

What It Does Not

Hide anything at all
Stop somebody reading the file
Say who changed it. Or when
Let you get the file back from the hash

The right column is why a hash is published openly alongside a download. There is nothing in it to keep private, which is the point.

This is the check an archive needs and rarely gets. Take the hash of a mailbox export the day it is made and keep it with the file. Years later you can prove the file is the one you made rather than a copy something touched along the way. Encryption cannot answer that question and never claimed to.

Where the Hashing And Encryption Algorithms Stand

Not all hashes are equally trustworthy. What you are defending against decides which one you need.

MD5 Fine for accidents, useless against intentA pair of files sharing one value can be produced deliberately. For catching a corrupted download it still works
SHA-1 Broken the same way, laterA deliberate collision was demonstrated publicly. Withdrawn from serious use
SHA-256 The ordinary answerPart of the SHA-2 family, widely implemented and the sensible default for anything that has to hold up

The distinction is between an accident and an adversary. A file that got truncated in transfer will fail an MD5 check perfectly well. A file somebody wanted you to accept will not.

Why a Password Is a Weaker Promise Than Encryption

Documents and mail stores offer passwords. The word covers two quite different things.

What it says	What is happening
Password on a PST	Outlook refuses to open it. The bytes are not encrypted
PDF permissions password	A request that readers restrict printing. Honoured by choice
PDF open password	Real encryption. The content genuinely cannot be read
Password on a zip	Depends on the method. Older ones are weak, AES is not
Disk encryption	Real, covering everything on the disk at once

Two of those rows are protection and three are an application being polite. Nothing on screen distinguishes them. Both get described as password protected.

A password on a personal store is the clearest example. It stops Outlook and nothing else, since a tool reading the format has no reason to consult it. Anybody treating that as a reason to email the file has misread the setting.

Choosing Between Hashing And Encryption for a Real Job

Handing files to somebody outside. Encryption, on the container or the disk. A password on the document is not the same thing and the difference matters most exactly here.
Keeping an archive for years. Hash it and store the value alongside. It costs nothing and it is the only way to answer whether the file is still what you made.
Checking a large download or transfer. Compare hashes at both ends. MD5 is enough because you are catching accidents rather than attacks.
Producing files for a legal request. Hash everything before it leaves and keep the list. Being able to show a file is unchanged is often part of what was asked.
Nothing at all. Base64. It is a transport convenience and it appears in every message you send, which is the whole of its job.

Nothing here replaces advice about a particular system. These are the shapes of the three tools rather than a security policy. Where a regulator or a client has said what they need, that instruction beats any general rule including this one.

Where the file is a mailbox and the question is whether the copy you hold matches the one you made, hashing is the answer and it costs nothing. Our file tools generate one in the browser without the file leaving your machine, which is the same arrangement the viewers use.

Definitions and the status of the named algorithms checked against the referenced articles in August 2026. Nothing here is security advice for a specific system.

Questions People Ask

7 questions, answered in full below.

What is the difference between hashing and encryption?

Encryption is reversible with the key and exists to keep something private. Hashing is not reversible at all and exists to prove something has not changed. One protects content while the other proves integrity. No key turns a hash back into a file.

Is base64 a form of protection?

No. It is the most common misunderstanding of the three. Base64 converts bytes into safe characters so they survive a journey. Anyone holding the result decodes it in seconds with no key and no effort, because none was ever involved.

Why do people hash a file?

To prove it is the same file later. Take the hash today and again in a year. Matching values mean not one byte moved. That is exactly the question an archive needs answered and encryption cannot answer it.

Is a password on a PST or a PDF real protection?

It restricts the application rather than the file. Outlook honours the password and software reading the format directly need not. A PDF is stronger where real encryption was applied. It is weaker where the password only sets permissions a reader chooses to respect.

Should I still use MD5?

For spotting an accidental change, it works and it is fast. For anything where somebody might construct a match on purpose, no. Two different files with the same MD5 can be produced deliberately, which was demonstrated long ago and has only become easier.

What does salting do?

It adds a unique value to each password before hashing, so two people choosing the same password store differently. That stops one precomputed list unlocking many accounts at once. It applies to stored passwords rather than to files.

Which should I use for a mailbox export?

Both, for different jobs. Encrypt the disk or the container so the contents cannot be read by whoever finds it. Hash the file so you can prove years later that nothing in it changed. Neither substitutes for the other.

Sources

Where the figures and behaviour described above were checked.

Cryptographic hash function Wikipedia
MD5 Wikipedia
Encryption Wikipedia