Encoding is not encryption

4 min read

The first crypto bug most people meet is not a broken cipher — it is something that was never a cipher at all. Base64, hex, URL-encoding and JWT payloads are encodings: reversible by anyone, no key involved. When an app stores a role, a price, or a user id in a base64 blob and trusts it, there is no cryptography protecting it, only the hope that you will not think to decode it.

A real cryptosystem has three separable properties, and attacks usually target the one the designer forgot:

• Confidentiality — can an observer read it? (Encoding gives you none.)
• Integrity — can an attacker change it undetected? (A missing or forgeable signature loses this even when confidentiality holds.)
• Authenticity — do you know who produced it?

Most "crypto" vulnerabilities are integrity or authenticity failures wearing a confidentiality costume. The token looks scrambled, so nobody checked whether it could be forged.