Base64 Is Not Encryption (And Other Common Misconceptions)
Base64 shows up everywhere: emails, data URLs, HTTP headers, JWTs. Because the output looks scrambled, it is often mistaken for encryption. It isn't. Base64 is an encoding: a reversible way to represent binary data as plain text, with no key and no secret. How Base64 works Base64 takes your data three bytes (24 bits) at a time and splits them into four groups of six bits. Each 6-bit value (0 to…
Base64 is frequently mistaken for encryption, but it is merely an encoding method that converts binary data into a text format. It is reversible, meaning anyone can decode it, and does not offer any secrecy or confidentiality. Base64 works by taking three bytes of input and splitting them into four groups of six bits, each mapped to a character from a 64-character alphabet. If the input length isn't a multiple of three, the output is padded with "=" characters.
Base64 is used to move binary data through text-only channels, such as email attachments and JSON fields. It can also embed small images or fonts directly in HTML or CSS via data URLs. It is the basis for HTTP Basic authentication, which encodes the username and password. However, this method does not provide any protection and should only be used over HTTPS.
Base64 is commonly used in JSON Web Tokens (JWTs), which use the URL-safe variant for their three segments. The padding character "=" at the end indicates that the input length wasn't a multiple of three bytes. URL-safe Base64 replaces "+" and "/" with "-" and "_" for safer usage in URLs, filenames, and JWTs. While Base64 changes the representation of data, it is not compression, as it always makes data larger due to its 33% overhead.
Contrasting with encoding, hashing, and encryption, encoding is reversible and does not provide secrecy. Hashing is a one-way process where the original data cannot be retrieved, but it can verify whether an input matches. Encryption is reversible only with the correct key, providing confidentiality. For secrecy, use authenticated encryption methods like AES-GCM with a properly generated key or a well-reviewed library that handles it securely.
When storing passwords, use slow, salted hash functions like bcrypt or Argon2. Never create your own scheme or rely on Base64 as a security layer.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.