Compression is not encryption, and five other confusions worth clearing up
By Dylan Wolpe
The short version
- Compression makes data smaller and is fully reversible by anyone; encryption makes data unreadable and is reversible only with a key. Neither provides the other's guarantee.
- Hashing proves content has not changed; signing proves who said so. A hash alone establishes integrity but not origin, which is why an unsigned hash on your own website proves very little.
- Deduplication removes repeated objects across a corpus; compression removes redundancy within data. They stack, and quoting one as though it were the other inflates a ratio dramatically.
- Tamper-evident means alteration is detectable. Tamper-proof means alteration is impossible, which essentially nothing is — treat the two words as different claims.
These distinctions are not pedantry. Each pair below appears in procurement documents, security questionnaires and vendor claims as though the two halves were interchangeable, and each confusion leads somewhere expensive — usually to an organisation believing it has bought a guarantee it has not.
1. Compression is not encryption
Compression makes data smaller. Encryption makes data unreadable without a key. The confusion persists because both produce output that looks like noise to a human.
The difference that matters: compression is reversible by anyone. There is no secret. Any competent tool undoes it. Encryption is reversible only by someone holding the key.
| Compression | Encryption | |
|---|---|---|
| Purpose | Smaller | Unreadable |
| Requires a secret | No | Yes |
| Reversible by anyone | Yes | No |
| Provides confidentiality | No | Yes |
| Output size | Smaller | Same or slightly larger |
The practical failure is the password-protected archive, where one format bundles both and older implementations of the encryption half are weak. A file being compressed tells you nothing whatsoever about who can read it.
If you take one thing: compression has no secret in it. That single fact settles most of the confusion.
2. Lossless is not the same as “lossless”
Lossless means the reconstruction is bit-identical to the input. Lossy discards information and can never return the original.
The word gets stretched. “Visually lossless” is lossy. “Statistically equivalent” is lossy. “Lossless after normalisation” usually means something was rounded before the lossless part began. The only unambiguous test is whether the hash of the reconstruction equals the hash of the original — which is why we describe our own output as verified lossless: the check was actually run, not merely available.
3. Hashing is not signing
A hash is a fingerprint: recompute it, compare, and you know whether content changed. A signature binds a statement to a party who cannot later deny making it.
Publishing a hash of your own archive on your own website proves almost nothing, because you can alter the archive and publish a new hash in the same minute. A hash becomes evidence only when it is signed, or when someone who is not you is holding a copy of it. That is the entire reason anchoring exists as a practice.
4. Deduplication is not compression
Deduplication notices that the same object appears many times and stores it once. Compression notices redundancy inside data and encodes it more briefly. Both reduce storage, by different mechanisms, at different scales.
They also stack, which is where the numbers get slippery. A backup corpus of near-identical nightly snapshots might dedupe 20:1 before any compression happens. Quote the combined figure as a compression ratio and you have inflated it by more than an order of magnitude. When a vendor cites a large number, the useful question is which part is dedupe and which is compression — and whether your data has the repetition dedupe needs.
5. Tamper-evident is not tamper-proof
Tamper-evident means alteration is detectable after the fact. Tamper-proof means alteration is impossible.
Essentially nothing is tamper-proof. Someone with sufficient access can always destroy a record; what you can prevent is their changing it and having it still look valid. Vendors who use the two words interchangeably are usually selling the first and pricing the second.
6. Immutable is not append-only
Append-only means you may add but not modify or delete. Immutable means nothing changes at all. An append-only log is not immutable — it grows — and that is the point.
The distinction matters when someone asks for an “immutable audit trail”. Taken literally that is a log that can never be written to again. What they want is append-only with tamper-evidence, which is a different and achievable thing.
Why we wrote this down
Because we answer these in sales conversations weekly, and because the confusions are not random — they cluster around exactly the places where a buyer is trying to establish what guarantee they are getting. Someone asking “is it encrypted?” when they mean “can my auditor rely on it?” will accept a yes that does not answer their real question.
If you are evaluating anything in this category, the most useful move is to make the vendor state which of the six they mean, in your words, in writing. The answers separate quickly.
Questions people ask about this
Does compressing a file make it secure?
No. Compression is fully reversible by anyone with a decompressor and no secret at all. A password-protected zip conflates the two ideas: the zip format compresses, and a separate encryption layer secures, and older zip encryption is weak. If you need confidentiality, encrypt; compression is not a security control in any form.
Should I compress before encrypting, or encrypt before compressing?
Compress first, because encrypted data is indistinguishable from random and will not compress at all. The caveat is that compressing before encrypting lets the ciphertext's length leak information about the plaintext, which has been exploited in real attacks on web traffic. For stored archives this is usually acceptable; for interactive protocols carrying attacker-influenced data it is not.
What is the difference between lossless and lossy compression?
Lossless reconstructs the original bytes exactly, verifiable by comparing hashes. Lossy discards information judged imperceptible and can never reproduce the original. For records, logs, financial and scientific data, only lossless is defensible — and 'verified lossless' should mean the hash was actually checked, not that the format is lossless in principle.
Is a hash the same as a digital signature?
No. A hash proves content has not changed since the hash was taken. A signature proves a specific party asserted it. Anyone can recompute a hash over altered data and publish the new value, so a hash is only evidence if it is either signed or held by someone who is not you.
Is deduplication a type of compression?
They solve the same problem at different scales. Deduplication removes whole repeated objects or blocks across a corpus; compression removes redundancy inside data. They multiply, so a vendor quoting a combined figure as a compression ratio is describing something else. Ask which number is which.