Base64 is encoding, not encryption — five myths worth dropping

Base64 shows up in email attachments, data URIs, HTTP headers and JWTs — and it is the most misunderstood format on the web. Five myths, corrected.

Myth 1: it hides data

Base64 is a reversible encoding, not encryption. There is no key; anyone can decode it in microseconds. If a string starts with a payload in Base64, treat it as plain text.

Myth 2: it compresses

The opposite: every 3 bytes become 4 characters — about a 33% size increase. Its real job is turning binary data into safe printable characters for text-only channels.

Myth 3: the = padding is decorative

Padding marks the tail of a group. Broken or stripped padding is the number-one cause of decode errors.

Myth 4: it is URL-safe by default

Standard Base64 uses + and /, which break in URLs and filenames. The URL-safe twin swaps them for - and _.

Myth 5: good for passwords

Encoding a password in Base64 adds zero security. Hash with a real algorithm (bcrypt/argon2) instead.

Want to check what a string really contains? Decode or encode Base64 in your browser — nothing leaves your device.