Base64 shows up everywhere: emails, data URLs, HTTP headers, JWTs. Because the output looks scrambled, it is often mistaken for encryption. It isn't. Base64 is an encoding: a reversible way to represent binary data as plain text, with no key and no secret.
How Base64 works
Base64 takes your data three bytes (24 bits) at a time and splits them into four groups of six bits. Each 6-bit value (0 to 63) maps to one character from an alphabet of 64: A-Z, a-z, 0-9, +, and /. If the input length isn't a multiple of three, the output is padded with = characters.
"hello" → aGVsbG8=
"hello!" → aGVsbG8h
"hi" → aGk=
Going the other way needs nothing but the same table, so anyone can decode it in seconds.
Never rely on Base64 to hide anything
If a password, API key, or token is only Base64-encoded, treat it as plain text. Anyone who sees it can read it.
What Base64 is genuinely for
- Moving binary data through text-only channels, such as email attachments (MIME) and JSON fields.
- Embedding small images or fonts directly in HTML or CSS as data: URLs.
- The HTTP Basic authentication header, which Base64-encodes username:password. This offers no protection, so it must only be used over HTTPS.
- JWTs, which use the URL-safe variant for their three segments.
Details worth knowing
- Size overhead: the output is about 33% larger than the input, because 3 bytes become 4 characters.
- URL-safe Base64 replaces + and / with - and _ and often drops the = padding, so the result can sit safely in URLs and filenames.
- Text encoding matters: convert text to bytes (usually UTF-8) before encoding, or non-ASCII characters will break. Browser atob and btoa only handle Latin-1 directly.
- Base64 is not compression; it always makes data bigger.
Encoding vs hashing vs encryption
- Encoding (Base64, URL encoding) changes the representation. It is reversible by anyone and provides no secrecy.
- Hashing (SHA-256, bcrypt) is one-way. You can't get the original back, only check whether an input matches.
- Encryption (AES-GCM, ChaCha20) is reversible only with the right key. This is what provides confidentiality.
If you need secrecy
Use authenticated encryption such as AES-GCM with a properly generated key, or a well-reviewed library that does it for you. Store passwords with a slow, salted hash such as bcrypt or Argon2. Never invent your own scheme, and never treat Base64 as a security layer.
Frequently asked questions
Is Base64 encryption?
No. Base64 is a reversible encoding with no key, so anyone can decode it. It provides no confidentiality.
Why does Base64 make data larger?
Every 3 bytes of input become 4 characters of output, so the encoded data is roughly 33% bigger.
What does the = at the end of Base64 mean?
It is padding, added when the input length isn't a multiple of three bytes. URL-safe variants often omit it.
What is URL-safe Base64?
A variant that replaces + and / with - and _ so the output can be used safely in URLs, filenames, and JWTs.
Try it: Base64 & URL Encoder — free, runs in your browser, nothing is uploaded.
Originally published at ilovekit.app.
