Encoding and hashes

Encoding changes how data is written down. Encryption hides data so only a key holder can read it. Beginners mix the two up. That mistake is how people end up storing passwords in base64 and calling them safe. This lesson shows you how to encode and decode with common tools. You will also look inside a file, and check that a download arrived intact.

What you'll be able to do

• Explain why encoding is not encryption.
• Encode and decode text and files with base64.
• Apply ROT13 with tr and see why it is a toy, not a lock.
• Read a file byte by byte with xxd and hexdump -C.
• Pull readable text out of a binary with strings.
• Check a download with sha256sum and explain why a hash is one-way.

Step 1: Encoding is not encryption

Encoding is a public rule, and it reverses cleanly. Anyone can undo it without a key. Base64 exists so binary data can travel through systems that only carry text. Email bodies and configuration files are common examples.

Encryption is different. It uses a secret key. Without that key, the data should stay unreadable. Base64 gives you no secrecy at all. Encode a password with it, and anyone who finds the string decodes it in one command.

Step 2: Encode text with base64

base64 reads standard input and writes the encoded text. Encode a short string.

echo "hello termux" | base64

aGVsbG8gdGVybXV4Cg==

The trailing Cg== is the newline that echo added. The == padding tells a decoder that the last block was not full.

Step 3: Decode it back

To reverse it, pass -d to base64 and feed the encoded text in.

echo "aGVsbG8gdGVybXV4Cg==" | base64 -d

hello termux

You get the original text back. This round trip needs no key. Anyone holding the encoded string can read the message.

Step 4: Encode and decode a file

The same tool works on files. Write a small file, then encode it.

echo "hello termux" > sample.txt
base64 sample.txt

aGVsbG8gdGVybXV4Cg==

Decode a file back to its original bytes with -d.

base64 -d sample.txt > decoded.txt
cat decoded.txt

hello termux

The > sends the decoded bytes into a new file instead of the screen.

Step 5: Apply ROT13 with tr

ROT13 shifts each letter thirteen places through the alphabet. It is a substitution cipher with no key, and it only touches letters. The tr command does the shift by mapping one set of characters onto another.

echo "Hello" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Uryyb

Shift the same text again and it comes back, because the alphabet has twenty-six letters and thirteen is half of that.

echo "Uryyb" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Hello

ROT13 hides a spoiler in a forum post. It stops nobody who wants to read your data.

Step 6: Read bytes with xxd and hexdump -C

xxd shows a file as hexadecimal, two bytes at a time, with the printable characters alongside.

echo "termux" | xxd

00000000: 7465 726d 7578 0a                       termux.

The first column is the offset in the file. The middle holds the hex bytes. The last column is the ASCII view. A printable character shows as itself. Everything else shows as a dot. Here 0a is the newline, so it appears as a dot.

hexdump -C prints the same idea in a slightly different layout.

echo "termux" | hexdump -C

00000000  74 65 72 6d 75 78 0a                              |termux.|

The bytes run one per column, and the ASCII view sits between two pipe characters. Reading that column is the quickest way to confirm a file is really text and not something else.

Step 7: Pull text out of a binary with strings

strings scans a file and prints every run of printable characters at least four long. That is how you find hidden messages, version numbers and paths inside a binary. Build a small file with text mixed with null bytes.

printf 'PNG\x00data\x00Author Ada\x00' > img.bin
strings img.bin

PNG
data
Author Ada

The null bytes are skipped and the readable runs are listed. Now pipe strings into grep to keep only the line you want.

strings img.bin | grep Author

Author Ada

Step 8: Verify a file with sha256sum

A hash turns any input into a short, fixed-length fingerprint. sha256sum prints the SHA-256 hash of a file. Write a file and hash it.

echo "hello termux" > sample.txt
sha256sum sample.txt

ffbcfdedca039b7ee5a26b0fecb97ce32323015ad538839491e7e08e0f176bb3  sample.txt

Change one character and the hash changes completely. Add an exclamation mark and hash again.

echo "hello termux!" > sample.txt
sha256sum sample.txt

728791eed6b294866d81946d22e93c145d87c0b9384a44023684a797fda689d6  sample.txt

Two files that differ by one character produce two hashes that share nothing. This is how you check a download. The site you downloaded from publishes the expected hash. Run sha256sum on your copy. If the two strings match, the file arrived intact. If they differ, it was corrupted or tampered with.

Step 9: Why a hash is one-way

A hash runs in one direction only. You can turn any file into its hash in an instant. You cannot turn a hash back into the file. There is no key and no undo. This is why a website can store the hash of your password. To check a login it hashes what you type and compares the two hashes. It never keeps your password.

The output is fixed in length, so many different inputs could in theory produce the same hash. A good hash makes finding such a pair impractical. That property, plus the one-way direction, is what makes hashes useful for integrity checks and password storage.

Quick reference

Command	What it does
base64 FILE	Encode a file or input as base64 text
base64 -d FILE	Decode base64 text back to its bytes
tr 'A-Za-z' 'N-ZA-Mn-za-m'	Apply ROT13 to letters
xxd	Show bytes as hex with an ASCII column
hexdump -C	Show bytes as hex with a boxed ASCII view
strings FILE	Print printable runs of text in a file
strings FILE piped to grep TERM	Keep only matching lines
sha256sum FILE	Print the SHA-256 hash of a file

Next steps

• Networking basics to download files and check their hashes before you open them.
• Managing packages to install the tools used in this lesson.
• File permissions to lock down a file that holds something private.

If either xxd or hexdump is missing, run pkg search xxd and pkg search hexdump. That finds the package which provides it. Install it with pkg install.