# Base64 Is Not Encryption (And Other Common Misconceptions)

Base64 shows up everywhere: emails, data URLs, HTTP headers, JWTs. Because the output looks scrambled, it is often mistaken for encryption. It isn't. Base64 is an encoding: a reversible way to represent binary data as plain text, with no key and no secret.

## How Base64 works

Base64 takes your data three bytes (24 bits) at a time and splits them into four groups of six bits. Each 6-bit value (0 to 63) maps to one character from an alphabet of 64: A-Z, a-z, 0-9, +, and /. If the input length isn't a multiple of three, the output is padded with = characters.

```
"hello"   →  aGVsbG8=
"hello!"  →  aGVsbG8h
"hi"      →  aGk=
```

Going the other way needs nothing but the same table, so anyone can decode it in seconds.

> **Never rely on Base64 to hide anything**
>
> If a password, API key, or token is only Base64-encoded, treat it as plain text. Anyone who sees it can read it.

## What Base64 is genuinely for

- Moving binary data through text-only channels, such as email attachments (MIME) and JSON fields.
- Embedding small images or fonts directly in HTML or CSS as data: URLs.
- The HTTP Basic authentication header, which Base64-encodes username:password. This offers no protection, so it must only be used over HTTPS.
- JWTs, which use the URL-safe variant for their three segments.

## Details worth knowing

- Size overhead: the output is about 33% larger than the input, because 3 bytes become 4 characters.
- URL-safe Base64 replaces + and / with - and \_ and often drops the = padding, so the result can sit safely in URLs and filenames.
- Text encoding matters: convert text to bytes (usually UTF-8) before encoding, or non-ASCII characters will break. Browser atob and btoa only handle Latin-1 directly.
- Base64 is not compression; it always makes data bigger.

## Encoding vs hashing vs encryption

- Encoding (Base64, URL encoding) changes the representation. It is reversible by anyone and provides no secrecy.
- Hashing (SHA-256, bcrypt) is one-way. You can't get the original back, only check whether an input matches.
- Encryption (AES-GCM, ChaCha20) is reversible only with the right key. This is what provides confidentiality.

## If you need secrecy

Use authenticated encryption such as AES-GCM with a properly generated key, or a well-reviewed library that does it for you. Store passwords with a slow, salted hash such as bcrypt or Argon2. Never invent your own scheme, and never treat Base64 as a security layer.

## Frequently asked questions

### Is Base64 encryption?

No. Base64 is a reversible encoding with no key, so anyone can decode it. It provides no confidentiality.

### Why does Base64 make data larger?

Every 3 bytes of input become 4 characters of output, so the encoded data is roughly 33% bigger.

### What does the = at the end of Base64 mean?

It is padding, added when the input length isn't a multiple of three bytes. URL-safe variants often omit it.

### What is URL-safe Base64?

A variant that replaces + and / with - and \_ so the output can be used safely in URLs, filenames, and JWTs.

**Try it:** [Base64 & URL Encoder](https://base64.ilovekit.app) — free, runs in your browser, nothing is uploaded.

*Originally published at [ilovekit.app](https://ilovekit.app/blog/base64-is-not-encryption).*