Everyone Can Learn Program
中文 Start learning
Specialty · SecurityLesson 2 of 9Free to read

Encoding and encryption · Cyber Security Basics

Is Base64 encryption? What actually keeps a message secret?

Course contents

Why you need it

Real leaks happen because someone believed scrambled-looking text was protected. Encoding, encryption and hashing look alike on screen but do very different jobs. Mixing them up is one of the most common security mistakes in code reviews.

The intuition

  • Encoding changes the alphabet so data can travel safely, like writing a message in Morse code. Anyone can turn it back: there's no key.
  • Encryption is a lock. Only someone with the key can turn the scrambled text back into the original.
  • Hashing is a fingerprint (lesson 3): you can't get the original back at all.

Two tools for this lesson:

  • ord("a") gives a character's number (97) and chr(97) turns the number back into "a".
  • ^ is XOR: it flips bits. XOR with the same key twice gives the original back, which is why it appears inside real ciphers.

Definition

Encoding vs encryption

Encoding transforms data into another format using a public scheme and needs no key to reverse. Encryption transforms data so that it can only be reversed with a secret key.

Key

The secret value that controls an encryption: the same algorithm with a different key gives a different result.

Examples

Base64 hides nothing

Try it yourself

Base64 turns bytes into letters and digits so they fit in emails and URLs. Decoding needs no secret.

import base64
secret = "pin=4821"
encoded = base64.b64encode(secret.encode()).decode()
print(encoded)
print(base64.b64decode(encoded).decode())
Step by step
  1. L3.encode() turns text into bytes; Base64 works on bytes.
  2. L4Looks scrambled, but it's just another alphabet.cGluPTQ4MjE=
  3. L5Anyone can decode it. No key was involved.pin=4821

A Caesar cipher has a key

Try it yourself

Each letter moves key places along the alphabet. Shifting back by the same key unlocks it.

def caesar(text, key):
    out = ""
    for ch in text:
        if "a" <= ch <= "z":
            out += chr((ord(ch) - ord("a") + key) % 26 + ord("a"))
        else:
            out += ch
    return out

locked = caesar("attack at dawn", 3)
print(locked)
print(caesar(locked, -3))
Step by step
  1. L4Only lowercase letters move; spaces stay.
  2. L5Letter → 0 to 25, add the key, % 26 wraps z back to a, then back to a letter.
  3. L10Lock the message with key 3.
  4. L11a→d, t→w, ...dwwdfn dw gdzq
  5. L12The same key in reverse unlocks it.attack at dawn

Common mistakes

Treating Base64 as protection

API keys and passwords "hidden" in Base64 are readable by anyone who sees them. If something must stay secret, encrypt it or don't store it.

Inventing your own cipher

Caesar and simple XOR are great for learning and broken in practice: there are only 26 Caesar keys. Real systems use well-tested algorithms such as AES through a library, and TLS for data on the network.

Quick quiz

1. What does this print?

def caesar(text, key):
    out = ""
    for ch in text:
        out += chr((ord(ch) - ord("a") + key) % 26 + ord("a"))
    return out

print(caesar("xyz", 2))
  1. A
    zab
  2. B
    z{|
  3. C
    abc
Show the answer

Answer: A

x→z, y→a (wraps around), z→b. The % 26 is what wraps.

2. Which of these can anyone turn back into the original, without a key?

  1. ABase64 text
  2. BAES-encrypted text
  3. CA SHA-256 hash
Show the answer

Answer: A

Base64 is encoding: public and reversible. AES needs the key, and a hash can't be reversed at all.

Practice

3 exercises in three steps: predict what a program prints, change a program to meet a new requirement, then write one from scratch. Your code runs in the browser and is checked the moment you submit.

  1. PredictXOR twice

    Type exactly what this program prints.

  2. ModifyCapital letters too

    This Caesar cipher only shifts lowercase letters. Change it so capital letters shift too and stay capital:

    caesar("Hello, World", 3) should return "Khoor, Zruog".

  3. WriteBreak the cipher

    Caesar has only 26 keys, so an attacker can simply try them all. Write crack(locked, word) that tries every key from 0 to 25 and returns the key that was used to lock the text, given one word you know appears in the original message.

    The caesar function is already there. Decrypting with key k means caesar(locked, -k).

Practise this lesson

Open the interactive lesson to edit and run these examples and solve the exercises with instant feedback. Free to start, no sign-up.

Open the interactive lesson Course map

Interactive lessons open in order. If you have not done the earlier ones yet, you start at the course map.

Terms in this lesson

TermChineseDefinition
Encoding编码Changing data into another format with a public, reversible scheme such as Base64.
Encryption加密Scrambling data so only someone with the key can read it.
Key密钥The secret value that controls encryption and decryption.
XOR异或 XORA bit operation; XOR with the same key twice returns the original value.