Base64 Isn't Encryption — People Still Get This Wrong
Published 2026-09-14
A real, recurring security mistake
It's a surprisingly common mistake: a configuration file, an API request, or a stored credential gets "encoded" in Base64 and treated as if that makes it secure or hidden. It doesn't. Base64 is a reversible, publicly documented encoding scheme with no key or password involved — decoding it takes any standard tool (including this site's own) a fraction of a second, with nothing secret to crack.
Why Base64 exists at all
Base64's actual purpose is solving a much older, more mundane problem: many older text-based systems (early email protocols in particular) could only reliably transmit a limited set of printable characters and would corrupt raw binary data — images, file attachments — if sent directly. Base64, standardized in the 1990s as part of the MIME email standard, works around this by representing any binary data using only 64 safe, universally supported characters (A-Z, a-z, 0-9, + and /), guaranteeing it survives transmission through systems that were never designed to carry raw binary safely.
The trade-off: it makes data bigger
Base64 isn't a compression technique — it's the opposite. Because it repackages every 3 bytes of original data into 4 text characters, Base64-encoded data is roughly 33% larger than the original. This is a deliberate, well-understood trade-off: more data in exchange for guaranteed safe transport through text-only systems.
Where Base64 is genuinely useful today
- Embedding small images directly in CSS or HTML as a data URI, avoiding an extra network request for tiny icons.
- Encoding binary data inside JSON, which has no native way to represent raw binary.
- The header and payload sections of a JWT are Base64URL-encoded (a URL-safe variant), which is exactly why they're readable by anyone without needing the signing key — a point covered in our JWT Decoder article.
The takeaway
If something genuinely needs to stay secret, it needs real encryption with a proper key, not Base64. If it just needs to survive being copied through a text field or embedded in a document without corruption, Base64 is exactly the right tool. Our Base64 Encoder/Decoder handles both directions instantly, including full Unicode text, entirely in your browser.