Base64 is not encryption

Base64 shows up in JWT payloads, data URLs, email attachments, and “secret” config files. The last use is the dangerous one. If you can decode it in a browser with no password, it was never a secret.

What Base64 is for

Some systems only accept a limited set of characters. A PNG file, a raw key, or a Unicode string can contain bytes that those systems will corrupt. Base64 rewrites those bytes using A–Z, a–z, 0–9, +, / and =. The result is longer — about 33% — and safe to paste.

Decoding reverses the rewrite. There is no key. Anyone with the string can recover the original bytes. TextFixer’s Base64 Decode tool does exactly that in your browser.

What people confuse it with

Encryption needs a key you do not publish. Hashing is one-way. Obfuscation hides intent but is still reversible. Base64 is none of these. It is an encoding, like URL encoding or HTML entities: a transport costume.

If you see an API token stored as Base64 in a repo, treat it as leaked. Rotate it. Do not “fix” it by encoding it twice.

A quick check

A Base64 string is usually a multiple of 4 characters and may end in one or two equals signs. That pattern is a hint, not proof. The honest test is: decode it. If you get the original text or file, you are looking at encoding, not a lock.