{
  "id": 18653544,
  "title": "Base64 is not encryption: what it is, when to use it, and the Unicode gotcha",
  "url": "https://urgent.news/2026/11/07/base64-is-not-encryption-what-it-is-when-to-use-it-and-the-unicode",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T06:23:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/naveen_hooda_6953b0025c1f/base64-is-not-encryption-what-it-is-when-to-use-it-and-the-unicode-gotcha-42ho"
  },
  "original_language": "en",
  "account": "Base64 is often mistaken as a method of securing data. However, this is not the case. It is simply a way to convert arbitrary bytes into text that only contains safe characters. This allows binary data to be placed in areas that only accept text, such as JSON, URLs, HTML, and email.\n\nCommon uses for Base64 include data URIs, HTTP Basic auth headers, parts of JWTs, and embedding small files in JSON APIs. Despite its widespread use, Base64 does not provide any form of encryption as there is no key or secret. Anyone can easily decode it using simple methods like JavaScript's atob function.\n\nOne of the downsides of Base64 is that it increases the size of the data by about 33%. While this may not be an issue for small icons or tokens, it can be a problem for larger files.\n\nThere is also a Unicode gotcha with Base64. The btoa function only handles characters in the Latin-1 range. If you try to use it with non-Latin characters, such as those in Hindi or emoji, it will throw an InvalidCharacterError. To avoid this issue, you can first convert the text to UTF-8 bytes and then encode those bytes using Base64.\n\nBase64 has a variant called Base64URL that is safer for use in URLs. This variant uses - and _ instead of + and /, which have special meanings in URLs.\n\nWhen using Base64, it's best to use it for moving binary data through text-only channels but avoid using it to hide anything. It's also recommended to avoid using it for large files and always convert non-English text through UTF-8. For quick checks while debugging, you can use a Base64 encoder/decoder from reliable sources. However, for anything sensitive, it's best to decode locally instead of using Base64.",
  "summary": "Every few months I see Base64 described as \"encoding for security.\" It isn't. Here's what it actually does. What Base64 is Base64 turns arbitrary bytes into text made only of safe characters ( A–Z , a–z , 0–9 , + , / , plus = padding). That makes it possible to put binary data in places that only accept text: JSON, URLs, HTML, email. Common uses: Data URIs: data:image/png;base64,... HTTP Basic…",
  "key_points": [
    "Base64 is data encoding, not encryption",
    "Used in data URIs, JWTs, and JSON APIs",
    "Increases data size by ~33%"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}