{
  "id": 17868225,
  "title": "Base64 in the Browser: UTF-8 Bytes, Padding and a Round Trip You Can Check",
  "url": "https://urgent.news/2026/11/02/base64-in-the-browser-utf-8-bytes-padding-and-a-round-trip-you-can",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T22:42:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/onepassapps/base64-in-the-browser-utf-8-bytes-padding-and-a-round-trip-you-can-check-4bkm"
  },
  "original_language": "en",
  "account": "Base64 is a method of converting bytes into printable ASCII characters. It is not encryption and can be decoded by anyone, but it has practical applications such as encoding API tokens or config snippets. When using a browser-based text editor with a Base64 tool, the encoding and decoding processes occur locally on the user's device, without the need to upload data to a server. The tool accepts text files up to 8 MiB in size and processes characters and bytes separately. For example, encoding the string \"OnePassApps base64 probe: café naïve\" results in 52 Base64 characters with a single padding of '='. The encoded string is deterministic and can be verified outside of the browser using Python's base64 module. If the input is not valid Base64, an error message is displayed, and the input remains unchanged. The tool is free to use with a limited number of credits, and the credits are primarily used for other features of the OnePassApps suite.",
  "summary": "Base64 is not encryption, but the paste box still matters Base64 turns bytes into printable ASCII. It is an encoding, not encryption - anyone can decode what you encode - but the practical problem is the same: a lot of web Base64 forms want your text on their server before they hand you the string back. If the text is an API token, a signed URL, a config snippet or a support thread, that round…",
  "key_points": [
    "Base64 converts bytes to printable ASCII characters, not encryption",
    "Browser-based tool encodes/decodes locally without server upload",
    "Encoded string deterministic, verifiable outside browser with Python"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}