Encoding is not encryption
Base64 maps bytes into a limited set of printable characters. It solves a transport problem: systems built for text can carry data that may contain arbitrary bytes. It does not use a secret key, and anyone who receives a Base64 value can reverse it.
The familiar equals signs at the end are padding. They complete a final encoding group and are not evidence that the data is protected.
Size and character encoding
Four Base64 characters represent three input bytes, so encoded data is typically about one third larger before surrounding markup or compression. Small values can be convenient inline; large images or documents are usually better transferred as files.
Text becomes bytes through a character encoding such as UTF-8 before Base64 is applied. If the decoder assumes a different character encoding, non-ASCII text may appear corrupted even when the Base64 itself is valid.
Safe uses and common mistakes
Base64 appears in email attachments, JSON fields, certificates and data URLs. Avoid placing credentials in it for secrecy, avoid repeatedly encoding an already encoded value, and distinguish standard Base64 from URL-safe variants that replace characters with forms suitable for URLs.
- Decode unknown content in a safe environment
- Do not log sensitive decoded payloads
- Check whether the receiving API expects raw bytes or Base64 text