✳ SECURITY BASICS · 7 MIN READ
Hashing vs Encryption: SHA-256, HMAC and AES-GCM Explained
A practical guide to SHA hashing, HMAC authentication, AES-GCM text encryption and the difference between encoding and encryption.
Open Text Hashing & Encryption Toolkit ↗Before choosing a cryptographic-looking transformation, decide what problem you want to solve: represent bytes, compare content, prove authenticity, or keep a message confidential. Those goals require different techniques.
1. Encoding: readable representations
Hex, Base64, URL percent encoding and HTML entities are reversible representations. They are useful for transport, debugging and output formatting but offer no secrecy. A password written in Base64 is still exposed to anyone who decodes it.
2. SHA-256: a one-way fingerprint
SHA-256 creates a 256-bit digest. For example, abc yields ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. A digest can help confirm that two copies of data match, but it does not by itself authenticate who produced that data.
Hashes are not reversible encryption. For storing login passwords, don't use a single fast SHA-256 hash: dedicated password hashing schemes such as Argon2id or scrypt with proper salts and parameters are more appropriate.
3. HMAC: authenticity with a shared secret
HMAC-SHA256 combines the content with a secret key. It is used, for example, when verifying a webhook signature from a partner who shares a secret with your server. The signature is only meaningful when the message bytes and format exactly match the sender's specification.
4. AES-GCM: authenticated encryption
AES-GCM protects confidentiality and detects tampering, provided keys and nonces are handled correctly. The Vyblet demonstration uses 256-bit AES with a fresh random IV, and derives a key from a password using PBKDF2 with SHA-256 and a random salt. It produces a v1. payload that carries the ciphertext and decryption parameters, not the password.
Encryption creates a different ciphertext on each run because random values change. Decrypt using the entire payload and the original password. Losing the password can mean losing the message, and a weak password still enables guessing attacks. Do not use an experimental browser converter as your only secure storage system.
Which operation should you choose?
| Your goal | Operation |
|---|---|
| Make bytes printable | Base64 or Hex |
| Identify a document's contents | SHA-256 / SHA-512 |
| Verify a message using a shared key | HMAC-SHA256 |
| Hide and later recover a message | AES-256-GCM |
| Escape text in URLs or markup | URL or HTML encoding |
FAQ
Can I decrypt SHA-256?
No. A SHA-256 digest is a one-way hash, not ciphertext.
Why is SHA-1 marked legacy?
SHA-1 has known collision weaknesses and is not recommended for new security-sensitive designs.
Does AES-256 make any password strong?
No. Even strong encryption algorithms depend on strong passwords, careful key handling and a suitable threat model.
Practice what you learned.
Try these concepts with a small, non-sensitive sample in your browser.