"Base64 Is Not Encryption: What It's For and How to Read It"

There is a recurring bug report that goes something like: "the password is encrypted, look — cGFzc3dvcmQ=." That string is not encrypted. It is Base64, and anyone can turn it back into password in one step. Understanding what Base64 is (and is not) prevents a whole class of security mistakes.

What Base64 actually does

Base64 solves a transport problem, not a secrecy problem. Lots of systems — email headers, URLs, JSON, HTTP — expect text, but plenty of data is raw bytes (an image, a signature, an encryption key). Base64 maps every 3 bytes to 4 printable ASCII characters drawn from A-Z a-z 0-9 + /, with = padding at the end. The result survives systems that would mangle raw binary.

That is the whole job: make bytes safe to travel as text. It is fully reversible by design and requires no key — which is exactly why it provides zero confidentiality. You can confirm this yourself: paste cGFzc3dvcmQ= into the Base64 Encoder / Decoder and it decodes instantly.

Where you will meet it

• JWTs. A JSON Web Token is three Base64url chunks — header, payload, signature — joined by dots. The header and payload are encoded, not encrypted; the JWT Decoder reads them without any secret. (Base64url is a URL-safe variant that swaps +/ for -_ and drops padding.)
• Data URLs. data:image/png;base64,iVBOR... embeds a whole file inline in HTML or CSS.
• Email (MIME). Attachments and non-ASCII headers are Base64-encoded so they pass through mail servers intact.
• Config and API payloads. Keys, certificates, and binary blobs are routinely Base64'd to fit inside JSON or environment variables.

The mistake to avoid

Base64 looks scrambled to a human, and that resemblance to "encrypted" is the trap. Treating it as protection leads to real leaks:

• Storing "encoded" secrets. A Base64'd API key in a repo or a cookie is a plaintext API key with extra steps. Encode ≠ encrypt.
• Trusting a JWT payload. Because the payload is only encoded, it is attacker-readable and attacker-editable until a signature check proves otherwise. (More on that in JWT Security in 2026.)
• Assuming size stays the same. Base64 inflates data by about 33% (4 characters per 3 bytes). That matters for URL length limits, cookie size caps, and payload budgets.

If you genuinely need confidentiality, you need encryption — a keyed transformation — not encoding. For sharing a secret safely, the Secure Paste tool encrypts text in your browser with a real cipher and shares it as a link, which is the difference that actually matters. To understand the underlying idea in more depth, see Base64 Explained.

The one-line rule

Base64 answers "how do I move these bytes through a text-only channel?" — never "how do I keep these bytes secret?" If you catch yourself calling Base64 "encryption," that is the moment to reach for an actual cipher instead. Decode a sample in the Base64 Encoder / Decoder once and the point makes itself: no key required, no secrecy provided.