Developer tools Explainers
Base64 encoding is not encryption: a small example explains why
Understand Base64 and Base64url, learn why encoded text is not secret, and troubleshoot padding, Unicode and binary data before decoding.
SGVsbG8= looks less readable than Hello, but it is not a protected version of the message. It is the same data written using an encoding designed to carry bytes through text-oriented systems. Knowing that distinction prevents a common security mistake.
Try a round trip with harmless sample text
Open the Base64 tool, enter Hello in the plain-text input and encode it. Copy SGVsbG8= into the encoded input and decode it. The original message comes back without a password or secret key. That reversibility is the point of the encoding, not a weakness in the calculator.
Plain text: Hello
UTF-8 bytes, hexadecimal: 48 65 6c 6c 6f
Base64: SGVsbG8=
Decoded text: HelloWhat changes in the representation
Base64 represents each group of three input bytes using four encoded characters, with padding for an incomplete final group. It usually increases size by roughly a third rather than compressing the data. The exact output length depends on the input byte count.
The standard alphabet includes + and /. Base64url uses - and _ instead; padding conventions depend on the protocol. RFC 4648 defines these formats. Do not assume a plain Base64 text tool accepts every protocol’s variant.
Sources: MDN: Base64 alphabets, size and Unicode handling · RFC 4648: Base64 and URL-safe Base64
Do not use encoding as secret storage
Putting an API key or password through Base64 does not protect it from someone who can read the resulting string. If a setting or URL exposes the encoded value, treat the original secret as exposed too. For actual confidentiality, use the security mechanisms designed for your application.
ToolBarKit’s Base64 codec sends input to its backend for processing. Use a local workflow for confidential values rather than assuming it has the same browser-only processing as the JWT decoder. Check the site’s privacy information when selecting a tool.
When a value will not decode into readable text
Check that you copied the complete value, including any required trailing = characters. Remove a surrounding label or data-URL prefix only if you know it is not part of the encoded content. Determine whether the producer used Base64url before changing characters.
A successfully decoded value may contain binary file bytes rather than text. Forcing those bytes into a text decoder does not turn an image into a sentence. Unicode text also needs an agreed byte encoding, commonly UTF-8; JavaScript’s older btoa helper cannot directly encode every Unicode string.
Common questions
Can Base64 be decoded without a password?
Yes. Base64 requires no secret key. Whether the recovered bytes are themselves encrypted is a separate question.
Is Base64 a way to make a file smaller?
No. It normally adds size. Use an appropriate compression format when size reduction is the goal.
Sources and further reading
This guide combines the linked references with examples and the current behavior of ToolBarKit’s tools. Published by the ToolBarKit team; external guidance and tool behavior can change.