Base64 is not encryption (and three things people mix up with it)

Every few weeks someone shows us a string like cGFzc3dvcmQxMjM= and asks how "encrypted" it is. The honest answer tends to disappoint: not at all. That is Base64, and anyone can read it back in about two seconds.

Base64 turns up everywhere — data URLs, JWTs, email attachments, API responses — so it pays to know what it really is. The confusion is understandable. Let's clear it up.

What Base64 actually does

Base64 is an encoding, not encryption. Its job is boring and useful: take arbitrary binary data and write it using only 64 plain-text characters (A–Z, a–z, 0–9, and two extras). There's no key, no secret, nothing to crack. Decode cGFzc3dvcmQxMjM= and you get password123, plain as day.

Why does it exist? History, mostly. Plenty of systems — email being the classic — were built to move text around reliably but choke on raw bytes. Encoding the bytes as text gets them through intact. The cost is size: Base64 output runs about a third larger than the input, because you spend more characters to stay inside that safe alphabet.

Three mix-ups we see a lot

"It's encoded, so it's safe to store." No. Base64 a password, an API key, or a customer email and drop it in a log file, and you've stored it in plain text wearing a thin disguise. Anyone who reads the log can decode it. If something needs to stay secret, it needs real encryption — and for passwords, hashing.

"The JWT is encoded, so the contents are hidden." A standard JWT is three Base64url chunks joined by dots. The middle chunk is the payload, and anyone can read it — paste it into a decoder and the claims are right there. The signature stops people changing the token, not reading it. So never put anything in a JWT payload that you wouldn't want the user to see.

"Base64 and Base64url are the same." Close, but the difference bites. Standard Base64 uses + and /, which mean something special in URLs, plus = padding. Base64url swaps those for - and _ and often drops the padding, so the string survives inside a URL or a token. Decode one with the wrong variant and you get garbage or an error.

So when should you use it?

Use Base64 when you need to carry binary data through a text-only channel: inlining a small image as a data URL, embedding a file in JSON, tucking a value into a header. It's for transport and representation. It's not for secrecy — that's a different tool entirely.

If you just want to see what a string decodes to, our Base64 encoder and decoder runs in your browser, so you can paste even sensitive values without them leaving your machine. For tokens, the JWT decoder shows you exactly what is inside.