Base64 Is Not Encryption — Stop Treating It Like One

I was on a forum the other day and saw someone say, "I encrypt all my API keys with Base64 before storing them."

I made a noise. It wasn't a human noise. It was the sound of a developer who has just bit through their own tongue.

Base64 Is a Coat of Paint, Not a Safe

Let's get this straight. Base64 is not encryption. It's not even obfuscation, really. It's encoding. It's the digital equivalent of writing "pizza" in cursive and calling it a secret. If I hand you cGl6emE=, and you paste it into our Base64 decoder, you get "pizza" in about 0.3 seconds. Congratulations, you've cracked the case, Sherlock.

Here's the rule of thumb: if there's a public tool that can reverse what you just did instantly, it is not security. Encryption requires a key. Base64 uses a lookup table. One of these things is not like the other.

The ROT13 of the Modern Era

I think people latch onto Base64 because it looks encrypted. The equal signs at the end! The random letters! The plus signs! It feels like a secret code. And to be fair, to someone who's never seen it before, dGhpcyBpcyBub3QgZW5jcnlwdGlvbg== does look like alien language.

But here's the thing — Base64 was invented so binary data could survive email attachments. It's a transport format. It's the way your email client sends a cat picture without corrupting the bytes. Nobody should be securing anything with it.

Yet people do. All the time. I've seen codebases where "encrypted" passwords were just Base64'd. I've seen "API key vaults" that were Base64 strings in a text file. I've seen — I'm not making this up — a startup's "proprietary encryption algorithm" that turned out to be Base64 with a hardcoded salt that was just the string "SALT".

They raised $2 million.

When You Actually Should Use Base64

Look, Base64 is great at what it's for. If you need to embed an image in an email, encode it. If you're passing binary data through a JSON API, encode it. If you need to turn your cat photo into a string of letters for some reason — go nuts. Our Base64 encoder is right there and it works perfectly.

But if you're trying to protect data, use actual encryption. AES, bcrypt, argon2 — pick your poison. They all require keys or salts that aren't just a publicly documented algorithm from the 1980s.

The Plea

Please, for the love of all that is holy, stop treating Base64 like a security measure. It's not encryption. It's not a password. It's not a secret. It's a party trick. Use it for what it's for, use actual crypto for actual secrets, and let me keep what's left of my tongue.