Guide
Base64 is not encryption
Distinguish encoding, encryption, and hashing, and learn why anyone can recover Base64 text without a key.
by Tools in a Tab · Published on · Reviewed on
Short answer
Base64 is an encoding that represents bytes with text characters. It uses no key, provides no confidentiality, and anyone receiving the string can decode it.
UTF-8 text: hello
Base64: aGVsbG8=Check both directions with the Base64 encoder. The result is deterministic: the same bytes produce the same encoded string.
Encoding, encryption, and hashing
| Operation | Goal | Reversible? | Requires a key? |
|---|---|---|---|
| Base64 | Carry bytes as text | Yes | No |
| Encryption | Hide content from unauthorized readers | Yes, with the right key | Yes |
| Hash | Produce a fixed-length fingerprint | Not directly | Not necessarily |
Changing how data looks does not protect it. Base64 appears in email, APIs, configuration, and protocols that require a text-safe alphabet.
Why the size increases
Base64 maps each group of 3 bytes to 4 characters. Excluding wrappers and line
breaks, the size grows by roughly one third. = padding completes the final
group when the input byte count is not divisible by three.
RFC 4648 defines the Base64 alphabet and padding as well as Base64URL.
Common security mistakes
- Storing a password “securely” with Base64 alone.
- Publishing a credential because it is no longer human-readable at a glance.
- Assuming a Base64URL JWT payload is encrypted.
- Putting sensitive Base64 data into a URL or log.
A signed JWT can protect integrity without encrypting its payload. Decoding it does not validate the signature, but it can reveal the claims. If you need confidentiality, use a managed cryptographic mechanism designed for it; Base64 only solves representation.