Base64. Both directions.

What Base64 is for

Base64 turns arbitrary bytes into 64 characters that survive being sent through things that only expect text: email bodies, JSON fields, URLs, HTTP headers. It is a transport format, not a security measure.

Three bytes become four characters, so the output is about a third larger than the input. That is the cost of the safety.

The = signs at the end

Base64 works in groups of three bytes. When the input does not divide evenly, the output is padded with one or two = characters so the length is always a multiple of four.

"a"    →  YQ==     (1 byte,  two padding characters)
"ab"   →  YWI=     (2 bytes, one padding character)
"abc"  →  YWJj     (3 bytes, none needed)

A decoder that rejects your string is often complaining about missing padding rather than about the data.

Base64url, and why JWTs use it

Standard Base64 uses + and /, both of which mean something else in a URL, and =, which has to be escaped. Base64url swaps them:

• + becomes -
• / becomes _
• Padding is usually dropped entirely

This is the variant inside a JSON Web Token. If a decoder chokes on a JWT segment, that is why — convert the two characters back and add the padding.

Where Base64 shows up in security work

Basic authentication

An Authorization: Basic header is just user:password in Base64. Paste one into the tool above and the credentials come straight out. This is why Basic auth over plain HTTP is equivalent to sending the password in the clear.

Encoded payloads

Attackers Base64 their payloads to slip past filters looking for literal strings, and malware embeds encoded blobs to avoid scanners reading them. Something long and Base64-shaped in a config file or a log line is worth decoding before ignoring.

Secrets that only look protected

Kubernetes Secrets store values in Base64, which regularly gets mistaken for encryption. They are readable by anyone with access to the manifest. The same goes for a config file where a password was "obfuscated" by encoding it.

Two things that go wrong

• Non-ASCII text. Base64 encodes bytes, not characters, so the result depends on the encoding used first. Encode as UTF-8 before Base64, on both ends, or accented characters and emoji come back mangled.
• Assuming decoded means safe. Decoding is not sanitising. Whatever comes out still needs escaping before it reaches a database, a shell, or a page.

This runs in your browser

The tool above encodes and decodes locally. Nothing is sent to a server — which matters given how often the thing being decoded is a credential someone found in a config file.

Finding encoded secrets in a codebase

Spartyx flags Base64-encoded credentials committed to source, Basic auth headers with embedded passwords, and secrets in configuration that were encoded rather than stored properly.

Scan a public repository free, no account needed.