Base64 is not encryption: what it is actually for
It looks scrambled, so people treat it as a secret. It is not. Anyone can turn it back in one click.
What it is for
Lots of systems were built for text and choke on raw bytes: email bodies, JSON strings, HTML attributes, HTTP headers. Base64 rewrites every 3 bytes as 4 characters from A–Z a–z 0–9 + /, which pass through anything. That is how images end up in data: URLs, attachments travel in email, and tokens fit into headers.
Why it is not a secret
There is no key. The mapping is public and the same everywhere, so decoding takes no effort at all. Credentials "protected" with Base64, such as HTTP Basic auth headers, are only safe because the connection itself is encrypted with HTTPS.
Encoding, hashing, encryption
| Reversible? | Needs a key? | Use it for | |
|---|---|---|---|
| Base64 (encoding) | Yes, by anyone | No | Moving bytes through text systems |
| SHA-256 (hashing) | No | No | Fingerprints, checking a file has not changed |
| AES (encryption) | Yes, with the key | Yes | Keeping something secret |
To send a password or secret to someone, use something that is actually encrypted, such as Fusenote, which encrypts in your browser and destroys the note after one read.
Small details that trip people up
- Size: output is about 33% bigger than the input (4 characters for every 3 bytes).
- Padding: the
=or==at the end fills the last group when the input length is not a multiple of 3. Some systems drop it. - Base64URL: a variant for URLs and JWTs that uses
-and_instead of+and/, usually without padding. Feeding one to a decoder that expects the other is a common cause of "invalid character" errors. - Text vs bytes: Base64 encodes bytes. Emoji and accented letters must first become UTF-8 bytes; JavaScript's old
btoa()fails on them, which is why the Base64 tool handles UTF-8 for you.
Related
Emoji turning into boxes or gibberish is usually a font or charset problem, not Base64: emoji shows as □ / tofu, mojibake (ðŸ / é), MySQL Incorrect string value / utf8mb4. Interactive walkthrough: Wirebook emoji lesson. · QR code not scanning / error correction
Questions
Is Base64 encryption?
No. It is an encoding with no key; anyone can decode it instantly. It only changes how data is written, not who can read it.
Why does Base64 end with ==?
It is padding. Base64 works in groups of 3 bytes, so when the input runs out one or two = signs mark the missing bytes.
Why is Base64 bigger than the original?
Every 3 bytes become 4 characters, so the output is about a third larger, plus any line breaks some encoders add.
Published .