Base64 is not encryption — what encoding actually does

Why encode at all?

Some channels are not binary-safe: JSON strings, email headers, XML documents and URL query parameters. Base64 turns arbitrary bytes into a restricted alphabet, avoiding control characters and delimiter collisions.

The cost is size. Every three input bytes become four output characters, plus padding. For large payloads, compression before encoding is usually more valuable than optimising the encoding itself.

Padding and variants

Standard Base64 uses A–Z, a–z, 0–9, + and /. The = character pads the final group so the length is a multiple of four. Some decoders tolerate missing padding; strict ones do not.

URL-safe Base64 replaces + with - and / with _, and often omits padding. If a token works in a header but fails in a query string, check which variant the producer used.

Encoding is not validation

Decoding Base64 proves only that the characters map to bytes. The bytes may be an image, a serialised object, a compressed stream or malicious content. Validate the decoded type before using it.

Never trust decoded data simply because it arrived Base64-encoded. Treat it exactly as you would treat the same bytes from any other untrusted source.

When to use real crypto

For confidentiality, encrypt with a modern authenticated cipher and manage keys separately from the ciphertext. For integrity, sign with a key the verifier can trust. Base64 may wrap the result, but it is not the protection.