Encoding != Encryption != Hashing

This is a very quick and highly simplified explanation about encoding, encryption and hashing and how they are different. Today I tweeted this:

encoding != encryption != hashing

You can decode, decrypt but there's no such thing like "dehashing". Hashing algorithms are one-way irriversible algorithms. Hashes can be cracked. #Infosec
— John Opdenakker - Lockdown counter: 28 (@j_opdenakker) April 14, 2020

I was genuinly surprised that this tweet got quite a lot of retweets and likes. However. From personal experience I know that a lot of people, including developers, have difficulties to distinguish the terms. Mainly the difference between encryption and hashing is not clear to many.

Hashes can be cracked, not reverted so that's why dehashing makes no sense to me. Pretty sure this is something a lot of people still don't understand, we see the proof often in data breaches or when I talk with developers. A term like dehashing is not helpful then.
— John Opdenakker - Lockdown counter: 28 (@j_opdenakker) April 14, 2020

Encoding is used to transform data from one data format into another such that the data can be exchanged between different systems. Think for instance about mp4 (video) encoding to transform other video formats into mp4. Encoding isn't designed for securing data and shouldn't be used as such. Encoded data can easily be decoded by applying the used transformation algorithm in the opposite direction.

Encryption is a security measure used to ensure confidentiality of data. It is a reversible transformation of plaintext into ciphertext using an algorithm, called a cipher, and an encryption key. The key should be properly secured and only shared with intended people, because together with the ciphertext and the algorithm it can be used to revert the ciphertext into the plaintext value.

Hashing algorithms are one-way transformations of the input into a hash value. The generated hashes are irreversible. There's no such thing as "dehashing".

Is that really true? Well In my option it is, and when there are somuch of data breach. But I’m other hand, what if you ever need? https://t.co/z8ukmK7Ze5
— shaansheikh (@shaansh48252531) April 14, 2020

There's also no reason you should ever want to do that for legitimate purposes because the purpose of hashing is to ensure integrity, not to revert the input from the hash value.

Let's take password hashing as an example to explain the principle.

Account registration

The user creates an account and specifies a username and password.
When the user clicks on the register button, the username and password are sent to the webserver (hopefully over the secure HTTPS protocol).
Server side, a random string (called salt) is added to the user's password and this value is transformed into a hash by using a cryptographic hashing function. Both the hash value and the salt are stored for each user. The purpose of the salt is to make each hash value unique even for users with the same password.

Account login

The user logs in with his username and password.
When the user clicks on the login button, the username and password are securely sent to the webserver.
Server side, the same cryptographic hashing algorithm used at account creation is used to hash the password specified by the user combined with the salt that is stored for this user.
Only if these two hash values match the user is granted access (=integrity check).

The same checks should be done at password change of course. Only if the hash of the original password that the user specified matches with the hash of the stored password he should be able to change his password.