Encoding

Data on the web is constantly re-shaped so it can travel safely: a password becomes Base64, a space in a URL becomes %20, bytes are written as hex. This is encoding, and the single most important thing to understand is that it is not encryption. Encoding uses a public, reversible rule with no key, so anyone can undo it.

The common encodings

Base64:  SGVsbG8=            ->  Hello          (letters, digits, + / and =)
Hex:     48656c6c6f          ->  Hello          (pairs of 0-9 a-f)
URL:     %48%65%6c%6c%6f     ->  Hello          (% before each byte)
ROT13:   Uryyb               ->  Hello          (each letter shifted 13)

You learn to recognise them by their alphabet: only letters, digits and maybe a trailing = is Base64; pairs of hex digits is hex; lots of % is URL-encoding.

Encoding is not encryption

Encryption needs a secret key, and without it the data cannot be read. Encoding needs no key — the rule is public — so it hides nothing from anyone who recognises it. Stacking encodings (Base64 of hex of ROT13) adds no security at all; it just adds steps to undo.