Base64 Is Not Encryption (And Other Common Misconceptions)

Base64 shows up everywhere: emails, data URLs, HTTP headers, JWTs. Because the output looks scrambled, it is often mistaken for encryption. It isn't. Base64 is an encoding: a reversible way to represent binary data as plain text, with no key and no secret.

How Base64 works

Base64 takes your data three bytes (24 bits) at a time and splits them into four groups of six bits. Each 6-bit value (0 to 63) maps to one character from an alphabet of 64: A-Z, a-z, 0-9, +, and /. If the input length isn't a multiple of three, the output is padded with = characters.

"hello"   →  aGVsbG8=
"hello!"  →  aGVsbG8h
"hi"      →  aGk=

Going the other way needs nothing but the same table, so anyone can decode it in seconds.

Never rely on Base64 to hide anything

If a password, API key, or token is only Base64-encoded, treat it as plain text. Anyone who sees it can read it.

What Base64 is genuinely for

• Moving binary data through text-only channels, such as email attachments (MIME) and JSON fields.
• Embedding small images or fonts directly in HTML or CSS as data: URLs.
• The HTTP Basic authentication header, which Base64-encodes username:password. This offers no protection, so it must only be used over HTTPS.
• JWTs, which use the URL-safe variant for their three segments.

Details worth knowing

• Size overhead: the output is about 33% larger than the input, because 3 bytes become 4 characters.
• URL-safe Base64 replaces + and / with - and _ and often drops the = padding, so the result can sit safely in URLs and filenames.
• Text encoding matters: convert text to bytes (usually UTF-8) before encoding, or non-ASCII characters will break. Browser atob and btoa only handle Latin-1 directly.
• Base64 is not compression; it always makes data bigger.

Encoding vs hashing vs encryption

• Encoding (Base64, URL encoding) changes the representation. It is reversible by anyone and provides no secrecy.
• Hashing (SHA-256, bcrypt) is one-way. You can't get the original back, only check whether an input matches.
• Encryption (AES-GCM, ChaCha20) is reversible only with the right key. This is what provides confidentiality.

If you need secrecy

Use authenticated encryption such as AES-GCM with a properly generated key, or a well-reviewed library that does it for you. Store passwords with a slow, salted hash such as bcrypt or Argon2. Never invent your own scheme, and never treat Base64 as a security layer.

Frequently asked questions

Is Base64 encryption?

No. Base64 is a reversible encoding with no key, so anyone can decode it. It provides no confidentiality.

Why does Base64 make data larger?

Every 3 bytes of input become 4 characters of output, so the encoded data is roughly 33% bigger.

What does the = at the end of Base64 mean?

It is padding, added when the input length isn't a multiple of three bytes. URL-safe variants often omit it.

What is URL-safe Base64?

A variant that replaces + and / with - and _ so the output can be used safely in URLs, filenames, and JWTs.

Try it: Base64 & URL Encoder — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.