0:00
There is something that confuses almost
0:02
every beginner in security, hashing,
0:04
encoding, and encryption. They sound
0:07
similar. People [snorts] even mix them
0:09
up all the time, but in reality, they
0:11
are completely different. This is a
0:13
Policy Point, and I will break it down
0:15
for you. If you don't understand this
0:17
clearly, you can end up making serious
0:19
mistakes while building real
0:20
applications. Before I continue, there's
0:23
so much I can't share on YouTube,
0:26
whether it's because of platform rules
0:28
or because some skills need deeper
0:30
hands-on explanations, many of my videos
0:32
got deleted, and that's why I created a
0:34
Policy Point learning community for you,
0:37
a place where I can share everything.
0:39
When you join, you're not just getting
0:40
another course, you're getting access to
0:42
complete ethical hacking guides, the
0:44
tools and techniques I wish someone had
0:47
handed me when I was starting out. And
0:49
here's the kicker, this is the stuff I
0:51
don't teach on here. No watered-down
0:53
content, no clickbait, just raw,
0:56
actionable knowledge. On top of that,
0:58
you'll join an exclusive community on
1:00
Discord. I pinned the link in the
1:02
comments section below, but it's not for
1:04
everyone. The link is only available for
1:06
those who are serious about the journey.
1:08
Back to the video, let's simplify this
1:10
in the easiest way possible. Let's start
1:12
with encoding. Encoding is simply about
1:15
changing the format of data. That's it.
1:18
You're not protecting it. You're not
1:20
hiding it. You're just converting it
1:21
into another form so that it can be
1:23
stored or transferred properly. For
1:25
example, if you have binary data like an
1:28
image, you can convert it into a text
1:31
format like Base64 so that it can be
1:33
sent through systems that only support
1:36
text. Another common example is URLs.
1:39
Certain characters like [music] spaces
1:41
or special symbols can break a URL, so
1:44
we encode them into a safe format. Now,
1:47
here's the important part. There is no
1:49
key. There is no secret. Anyone who
1:52
knows the encoding method can easily
1:54
decode it back to the original data. So,
1:57
encoding is reversible, does not use any
1:59
key, and is not meant for security at
2:01
all. Its only goal is to make data
2:04
easier to store, transfer, or process.
2:08
Now, moving on to encryption. This is
2:10
where actual security begins. Encryption
2:13
is used to protect data. You take your
2:15
original data and convert it into
2:17
something unreadable using a key or a
2:19
password, and only someone who has that
2:22
key can convert it back to the original
2:24
form. So, yes, encryption is reversible,
2:27
but only if you have the correct key.
2:29
Think about when you send sensitive
2:31
information like passwords, messages, or
2:34
banking details over the internet. That
2:37
data is encrypted. Even if someone
2:39
intercepts it, they won't be able to
2:41
understand anything without the key.
2:43
This is the main difference from
2:45
encoding. Encoding can be reversed by
2:47
anyone, but encryption requires a secret
2:50
key to reverse it. Common examples of
2:52
encryption include AES and RSA. [music]
2:56
So, encryption is used for security,
2:58
requires a key, and ensures that only
3:01
the intended person can read the data.
3:03
Now, let's talk about hashing. And this
3:05
is where things become completely
3:07
different. Hashing is a one-way process.
3:10
You take your data and convert it into a
3:12
fixed length string called a hash, but
3:15
once it is converted, you cannot get the
3:17
original data back. There is no way to
3:19
reverse it. No key, no decoding,
3:22
nothing. So, the obvious question is,
3:24
why do we even use hashing? Hashing is
3:27
used for verification, not for
3:29
protecting or transferring data. Let's
3:31
say you send some data along with its
3:33
hash. On the receiving side, the system
3:35
can hash the data again and compare it
3:38
with the original hash. If both match,
3:40
it means the data has not been changed.
3:43
But if even a single character is
3:45
modified, the hash will be completely
3:47
different. This is how we ensure data
3:49
integrity. Now, one of the most [snorts]
3:51
important real-world use cases of
3:53
hashing is storing passwords. You should
3:55
never store passwords as plain text
3:57
because if your database gets leaked,
4:00
attackers will immediately see all user
4:03
>> Instead, what we do is hash the password
4:05
and store the hash. When a user logs in,
4:08
we take the password they enter,
4:10
[snorts] hash it again, and compare it
4:12
with the stored hash. If it matches, the
4:15
user is authenticated. Now, there's one
4:18
more important concept here called salt.
4:20
Salt is just a random value added to the
4:22
password [music] before hashing. This
4:24
makes sure that even if two users have
4:26
the same password, their hashes will
4:28
still be different. This adds an extra
4:31
layer of security [music] and makes it
4:33
harder for attackers to crack passwords.
4:36
So, if we simplify everything, encoding
4:38
[snorts] is used to change the format of
4:40
data and is not meant for security.
4:43
Encryption is used to protect data and
4:45
requires a key to get the original data
4:47
back. Hashing is used to verify data and
4:51
cannot be reversed at all. And here's
4:54
the biggest mistake beginners make. They
4:56
think encoding is security. It's not. If
4:59
you use encoding to protect sensitive
5:01
data, you're basically leaving your
5:03
system exposed. So, always remember
5:06
this. If your goal is to transfer or
5:08
store data efficiently, use encoding. If
5:10
your goal is to protect sensitive data,
5:13
use encryption. And if your goal is to
5:15
verify data or securely store passwords,
5:18
use hashing. Once this clicks, a lot of
5:21
concepts in cybersecurity will start
5:23
making much more sense.
