Base64 looks like encryption to anyone who has not met it before. It turns readable text into an unreadable jumble, and that resemblance has caused a remarkable number of security incidents — credentials "protected" with an encoding that anyone can undo in one line.

Encode or decode anything with the Base64 Encoder / Decoder. It runs in your browser and transmits nothing.

What Base64 is for

It solves a transport problem, not a secrecy one.

Plenty of systems were built to carry text, not arbitrary binary data. Email headers, JSON fields, URLs, XML documents — feed raw bytes through any of them and something will mangle a control character or choke on a null. Base64 re-expresses binary data using 64 characters that survive that journey intact: A–Z, a–z, 0–9, + and /.

The trade is size. Every 3 bytes become 4 characters, so encoded data is about 33% larger than the original. That is the cost of passing through a text-only channel.

Why the padding is there

Base64 works in 3-byte groups. When the input does not divide evenly by 3, the output is padded with = to keep the length a multiple of four.

  • Input divisible by 3 — no padding
  • One byte left over — two ==
  • Two bytes left over — one =

Which is why so much encoded data ends in = or ==, and why that trailing sign is such a recognisable fingerprint. If you see it at the end of a long alphanumeric string, you are almost certainly looking at Base64.

base64url, and why your JWT looks different

+ and / are both meaningful in URLs, so standard Base64 breaks when embedded in one. base64url swaps them: + becomes -, / becomes _, and padding is usually dropped.

This is why JWTs contain hyphens and underscores but no plus signs, slashes or equals. If a decoder rejects a token segment, a base64url-to-Base64 conversion is usually the missing step.

The security mistake

Base64 provides zero confidentiality. There is no key. Decoding requires nothing but knowing it is Base64, and every language has a one-line function for it.

The most common real-world example is HTTP Basic authentication:

Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=

That decodes to admin:password123. Instantly, by anyone. Basic auth relies entirely on TLS for its protection — over plain HTTP it is equivalent to sending the password in the clear, because it is sending the password in the clear.

Related patterns worth recognising as findings:

  • Config files with "encrypted" values that are just Base64
  • API keys Base64-encoded in client-side JavaScript
  • Cookies holding Base64 user data with no signature — decode, edit, re-encode, and you have changed your own role
  • "Obfuscated" URLs in phishing emails, which decode straight to the real destination

That last one cuts both ways: Base64 in a suspicious email is a useful thing to decode, because attackers use it to hide payloads from simple filters.

When it is the right tool

Embedding a small image directly in HTML or CSS as a data URI. Attaching files to email, where MIME requires it. Putting binary data in a JSON field. Passing a certificate around as PEM, which is Base64 with header lines. Encoding binary safely into a URL parameter, using base64url.

All legitimate. None of them secrecy.

Recognising it

Base64 has a distinctive shape: only A–Z a–z 0–9 + /, length divisible by four, often ending in =. Text encoded from English tends to produce visible patterns — you start recognising aHR0cHM6Ly as the beginning of an encoded https:// after seeing it a few times.

If a string is that shape and you are wondering what it holds, decode it. It takes two seconds and there is no key to find.

Common questions

Is Base64 encryption?
No. It is an encoding with no key. Anyone can decode it.

Why does Base64 end in =?
Padding, so the output length is a multiple of four when the input is not divisible by three.

Why does my JWT not decode as Base64?
It is base64url — - and _ replace + and /, and padding is usually stripped.

Is it safe to Base64 a password?
No. It provides no protection at all. Hash passwords for storage, and use TLS in transit.

Where to go next