Encryption vs Encoding vs Hashing in Node.js World

A fresh look at the top 3 security methods

Data security is a critical concern in today’s digital world. Understanding the differences between encryption, encoding, and hashing can help you choose the right data protection strategy.

What is Encryption ?

Encryption is a method of transforming data in such a way that only authorized users can access it. It involves using an encryption algorithm and a secret key to turn the original data (plaintext) into an unreadable format (ciphertext).

Decryption is the reverse process, where the ciphertext is converted back into the original plaintext using the same secret key.

What is Encoding ?

Encoding is a process of converting data into another format using a specific scheme or an algorithm. The primary goal of encoding is to ensure data is available for proper transmission and storage.

Unlike encryption, encoding does not hide data from unauthorized users. The encoded data can be easily decoded using the same scheme.

What is Hashing ?

Hashing is a procedure that takes plaintext input and converts it into a fixed-size string (hash), usually a shorter representation.

The primary purpose of hashing is data integrity and is often used in message digests, password storage, and checksums. Given the same input, the hash function will always produce the same hash.

However, hashing is a one-way function; you can’t retrieve the original data from the hash.

Using Node.js for Encryption

We can use the built-in crypto library provided by Node.js for encryption and decryption tasks. Here's an example using the AES-256-CBC algorithm to encrypt and decrypt data:

const crypto = require('crypto');

const algorithm = 'aes-256-cbc';
const secretKey = 'vOVH6sdmpNWjRRIqCc7rdxs01lwHzfr3';
const iv = crypto.randomBytes(16);

function encrypt(text) {
    const cipher = crypto.createCipheriv(algorithm, secretKey, iv);
    const encrypted = Buffer.concat([cipher.update(text), cipher.final()]);
    return `${iv.toString('hex')}:${encrypted.toString('hex')}`;
}

function decrypt(hash) {
    const [ivHex, encryptedHex] = hash.split(':');
    const decipher = crypto.createDecipheriv(algorithm, secretKey, Buffer.from(ivHex, 'hex'));
    const decrypted = Buffer.concat([decipher.update(Buffer.from(encryptedHex, 'hex')), decipher.final()]);
    return decrypted.toString();
}

const data = 'Encryption is secure!';
const encryptedData = encrypt(data);
const decryptedData = decrypt(encryptedData);

console.log('Encrypted:', encryptedData);
console.log('Decrypted:', decryptedData);

Using Node.js for Encoding

Node.js provides support for encoding and decoding using the built-in Buffer class. Here's an example of how to encode and decode data in base64 format:

const data = 'I am a message!';
const encodedData = Buffer.from(data).toString('base64');
const decodedData = Buffer.from(encodedData, 'base64').toString('utf-8');

console.log('Encoded:', encodedData);
console.log('Decoded:', decodedData);

Using Bcrypt for Hashing

Bcrypt is a widely used library for hashing passwords in Node.js applications. The library’s significant advantage is its compatibility with other systems and languages.

Here’s an example of hashing a password using Bcrypt:

const bcrypt = require('bcrypt');

async function hashPassword(password) {
    try {
        const salt = await bcrypt.genSalt(10);
        const hashedPassword = await bcrypt.hash(password, salt);
        console.log('Hashed Password:', hashedPassword);

        // To verify the password later
        const isValid = await bcrypt.compare(password, hashedPassword);
        console.log('Is the password valid?', isValid);
    } catch (error) {
        console.error('Error:', error);
    }
}

const password = 'myPassword123';
hashPassword(password);

Wrapping Up

By understanding the differences between encryption, encoding, and hashing, and using Node.js libraries like Bcrypt and Crypto, you can secure your sensitive data effectively.

Choose the appropriate method based on your data security requirements:

• Encryption for confidentiality
• Encoding for data formatting
• Hashing for data integrity

Remember, the right tools and techniques will enhance your application security to protect you from malicious attacks and data breaches.