Base64 Encoding Explained

Aug 16, 2026

Base64 turns bytes into ASCII. It is encoding, not encryption, and JWT uses a URL-safe variant.

Encoding is not encryption

Base64 maps bytes to a 64-character alphabet so binary can travel through text protocols. Anyone can decode it. Do not treat Base64 as a way to hide secrets.

UTF-8 then Base64

Text should be encoded as UTF-8 before Base64. The Base64 encoder does that in the browser.

Base64URL

JWT replaces + and / and often drops padding = . That is Base64URL. A standard decoder may fail on a JWT segment. Use the JWT decoder for tokens.

Typical uses

Data URLs, HTTP basic auth (still not a modern password store), and inspecting opaque config values. Keep production secrets off shared screens.