Base64 Encoding Explained (It's Not Encryption)
Developer Tools - 5 min read - Published 2026-08-27
Base64 is one of the most commonly misunderstood pieces of everyday web technology, mostly because it looks like encryption - it turns readable text into a jumble of seemingly random characters - but it isn't, and treating it like it is has real security consequences.
What Base64 Actually Does
Base64 encoding exists to solve a specific, narrow problem: some systems (older email protocols, certain text-only data formats) can only reliably transmit a limited set of printable ASCII characters, and can't safely handle arbitrary binary data. Base64 re-represents any binary data using only 64 safe, printable characters (A-Z, a-z, 0-9, +, /), so it can pass through systems that would otherwise corrupt or reject the raw bytes.
Why It's Not Security
Base64 encoding and decoding require no secret key at all - anyone can decode a Base64 string with a single line of code in virtually any programming language, or a two-second search for an online decoder. It provides zero confidentiality. If you see a password, API key, or JWT token encoded in Base64 (JWTs, in fact, are Base64-encoded by design, not encrypted, for their header and payload sections), treat that data as fully readable by anyone who intercepts it - because it is.
A Real Consequence: JWTs
JSON Web Tokens are a good real-world illustration of this exact confusion. A JWT's header and payload are Base64Url-encoded, not encrypted - anyone can decode them and read the claims inside without knowing any secret. The only part of a JWT that requires a secret is the signature, which exists to let a server verify the token hasn't been tampered with, not to hide its contents. Never put genuinely sensitive data in a JWT payload expecting it to stay private.
When Base64 Is the Right Tool
Use Base64 when you need to embed binary data (an image, a file) inside a text-based format like JSON, XML, or a data URI in HTML/CSS - that's exactly the problem it was built for. Never use it as a substitute for actual encryption when confidentiality matters; for that, you need a real algorithm like AES, applied with a real secret key that only authorized parties have.