BackendBench
Coffee

Unravel โ€บ Java concepts โ€บ Security

I/O and data

Hashing, Base64 and encryption

MessageDigest hashes data (SHA-256), Mac signs it with a secret (HMAC), Cipher encrypts it, and Base64 turns bytes into safe text.

๐Ÿ”Ž Unravel this examplePrerequisites (1)

Learn these first

Strings: immutability, equality, common methods

At a glance

Mental model

A hash is a fingerprint: it identifies content but cannot be turned back into it.

What happens, in order
  1. 1Hash: MessageDigest.getInstance("SHA-256").digest(bytes) gives 32 bytesSame input, same hash; a tiny change gives a totally different one. Good for checksums and integrity.
  2. 2HMAC: Mac.getInstance("HmacSHA256") with a SecretKeySpec proves a message came from someone who knows the key (webhook signatures, JWT)
  3. 3Encryption: Cipher.getInstance("AES/GCM/NoPadding") with a random 12-byte IV that you store next to the ciphertextGCM also detects tampering.
  4. 4Passwords need a slow, salted hash (BCrypt, Argon2, PBKDF2 through SecretKeyFactory), never plain SHA-256
  5. 5Base64.getEncoder().encodeToString(bytes) makes bytes printable; the URL-safe variant uses - and _
Remember
Watch out
Hashing passwords with plain SHA-256Reusing an IV or hardcoding the keyTreating Base64 as secrecyComparing MACs with equals
Example (highlighted lines explain it)
import java.security.MessageDigest;import java.nio.charset.StandardCharsets;import java.util.Base64;import javax.crypto.Mac;import javax.crypto.spec.SecretKeySpec;public class Signing {  static String sha256(String s) throws Exception {    byte[] d = MessageDigest.getInstance("SHA-256").digest(s.getBytes(StandardCharsets.UTF_8));    return Base64.getEncoder().encodeToString(d);  }  static byte[] hmac(byte[] key, String msg) throws Exception {    Mac mac = Mac.getInstance("HmacSHA256");    mac.init(new SecretKeySpec(key, "HmacSHA256"));    return mac.doFinal(msg.getBytes(StandardCharsets.UTF_8));  }}
  1. line 1 uses MessageDigest, the core of Hashing, Base64 and encryption
  2. line 3 uses Base64, the core of Hashing, Base64 and encryption
  3. line 4 uses Mac, the core of Hashing, Base64 and encryption
  4. line 5 uses SecretKeySpec, the core of Hashing, Base64 and encryption
  5. line 8 uses MessageDigest, the core of Hashing, Base64 and encryption
  6. line 9 uses Base64, the core of Hashing, Base64 and encryption
Read the full explanation (about 1 min)

MessageDigest hashes data (SHA-256), Mac signs it with a secret (HMAC), Cipher encrypts it, and Base64 turns bytes into safe text. They solve different problems and are often confused.

A mental model

A hash is a fingerprint: it identifies content but cannot be turned back into it. Encryption is a locked box: only the key holder gets the content back. Base64 is only a different alphabet, like writing a message in capital letters: no secrecy at all.

How it works

Hash: MessageDigest.getInstance("SHA-256").digest(bytes) gives 32 bytes. Same input, same hash; a tiny change gives a totally different one. Good for checksums and integrity.

HMAC: Mac.getInstance("HmacSHA256") with a SecretKeySpec proves a message came from someone who knows the key (webhook signatures, JWT).

Encryption: Cipher.getInstance("AES/GCM/NoPadding") with a random 12-byte IV that you store next to the ciphertext. GCM also detects tampering.

Passwords need a slow, salted hash (BCrypt, Argon2, PBKDF2 through SecretKeyFactory), never plain SHA-256.

Base64.getEncoder().encodeToString(bytes) makes bytes printable; the URL-safe variant uses - and _.

Going deeper

Never invent your own scheme. MD5 and SHA-1 are broken for security. AES/ECB leaks patterns, and reusing an IV with GCM destroys its security. Compare secrets with MessageDigest.isEqual (constant time), not equals.

Keys do not belong in source code or Git. Load them from a key store or a secrets manager, and generate them with KeyGenerator or SecureRandom.

Base64 is not encryption and a JWT payload is only Base64: anyone can read it.

Under the hood

The JCA (Java Cryptography Architecture) looks up algorithms by name through a list of providers (SunJCE, SunEC, BouncyCastle if installed). AES uses the CPU AES-NI instructions when available.

Common mistakes

  • Hashing passwords with plain SHA-256.
  • Reusing an IV or hardcoding the key.
  • Treating Base64 as secrecy.
  • Comparing MACs with equals.

How Unravel recognises it

When you paste code, Unravel looks for these signs of hashing, base64 and encryption. Spotting them yourself is a good habit when you read unfamiliar code:

Part of a learning path

Related concepts

Spring Security basicsSpringRandom numbers and UUIDsJava languageCharacters, Unicode and encodingsJava language

Frequently asked questions

What is Hashing, Base64 and encryption?

MessageDigest hashes data (SHA-256), Mac signs it with a secret (HMAC), Cipher encrypts it, and Base64 turns bytes into safe text. They solve different problems and are often confused.

What are the most common mistakes with Hashing, Base64 and encryption?

Hashing passwords with plain SHA-256. Reusing an IV or hardcoding the key. Treating Base64 as secrecy. Comparing MACs with equals.

How can I see Hashing, Base64 and encryption in real code?

Paste your own Java into Unravel and it will point out where hashing, base64 and encryption appears, explain how it works at the detail level you choose, and draw the flow of the code around it.