The direct answer
Base64 is not encryption because decoding requires no secret. It is a reversible way to represent bytes using a limited alphabet of printable characters. If someone can read a Base64 value, they can normally decode it.
How Base64 works
The ASCII text Hello consists of five bytes. Base64 groups their bits into six-bit values and maps those values to characters:
Hello → SGVsbG8=The equals sign is padding used to complete the encoded grouping. It is not a password or security marker. Base64 usually increases data length because three input bytes are represented by four output characters.
Ordinary Base64 uses + and /. Base64url substitutes URL-friendly characters and commonly removes padding; JWT sections use that variant. Text must first be converted to bytes with a character encoding such as UTF-8. Browser btoa/atob APIs operate on Latin-1-style binary strings, which is why directly encoding emoji can fail.
Encoding, encryption, and hashing
| Operation | Purpose | Secret? | Reversible? |
|---|---|---|---|
| Encoding | Change representation | No | Yes |
| Encryption | Provide confidentiality | Key required | Yes, with the key |
| Hashing | Create a one-way digest | Usually no | Not designed to be reversed |
Encryption also needs correct modes, nonces or IVs, authentication, key derivation, and key management. Merely making text unreadable at a glance is not a security property.
Legitimate uses
- Embedding binary data in a text-only field.
- Representing small files in data URLs.
- Transporting bytes through formats that expect printable text.
- Encoding JWT sections with Base64url.
Security mistakes to avoid
Do not store passwords, API keys, personal data, or session secrets “protected” only by Base64. Do not assume a Base64-looking token is encrypted. Transport security such as HTTPS and appropriate application encryption solve different problems.
Try and inspect
The Base64 and AES tool lets you observe both operations. Its Base64 side uses browser btoa/atob. Its AES side uses AES-GCM, but derives the key with one SHA-256 pass over the passphrase rather than a salted, deliberately slow password KDF; treat it as an educational browser utility rather than a key-management system.
Next, see why decoding a JWT is not verification or review JSON parsing and comparison.