Lesson 5 — Cryptography Basics
Cryptography protects data. Understanding the basics helps you recognize weak implementations and communicate clearly with developers about security requirements.
Encoding vs Encryption vs Hashing
These three terms are often confused but mean very different things.
- Encoding transforms data into a different format so it can be transmitted safely. It is reversible and uses no secret key.
- Encryption transforms data so it cannot be read without a secret key, and can be reversed with the correct key.
- Hashing produces a fixed size fingerprint of data. It is one-way and cannot be reversed back into the original data.
Base64, Hex, and URL Encoding
These are common encoding schemes used to safely represent binary or special characters as plain text. They provide no security on their own — anyone can decode them instantly, so they should never be mistaken for encryption.
Hashing: MD5 and the SHA Family
A hash function takes an input of any size and produces a fixed length output. The same input always produces the same hash, but you cannot reverse a hash back into the original input. MD5 and SHA-1 are considered broken for security purposes today; modern systems use SHA-256 or stronger, combined with salting for passwords.
Symmetric vs Asymmetric Encryption
Symmetric encryption uses the same key to encrypt and decrypt data, so both sides must securely share that key in advance. Asymmetric encryption uses a key pair: a public key that anyone can use to encrypt, and a private key that only the owner has, used to decrypt. HTTPS relies on a combination of both.
Common Developer Mistakes
- Storing passwords in plain text instead of hashing them
- Hashing passwords without a unique salt per user
- Using outdated algorithms like MD5 or SHA-1 for security purposes
- Hardcoding encryption keys directly in source code
- Confusing encoding (like Base64) with actual encryption