Base64 encryption is a lie

Search for “Base64 encryption” and you will find thousands of questions, tutorials and even production code that treat Base64 as a way to protect data. It is not. Base64 is an encoding: a reversible, public, key-less transformation. Calling it encryption is like calling a translation into French “encryption”.

A two-second “attack”

cGFzc3dvcmQxMjM=

Paste it into any Base64 decoder and you get password123. No key, no brute force, no skill. Anyone who sees the value knows the secret.

Where people get hurt

• Kubernetes Secrets. The values in a Secret manifest are Base64-encoded, so many people assume they are encrypted. They are not: anyone with read access to the manifest (or a Git repository where it was committed) has the plaintext. Use encryption at rest, sealed secrets or an external secret manager.
• HTTP Basic authentication. Authorization: Basic dXNlcjpwYXNz is just user:pass. Basic auth is acceptable only over HTTPS. Decode such a header with the Basic Auth decoder to see for yourself.
• JWT payloads. The payload of a JSON Web Token is readable by anyone who has the token. The signature prevents modification, not reading. Never put secrets in a JWT payload — check what yours contain with the JWT decoder.
• “Obfuscated” API keys in mobile apps and front-end code. Base64-encoding a key in a JavaScript bundle protects nothing; automated scanners decode Base64 routinely.
• Configuration files and URLs with “encrypted” passwords that are really just Base64.

Encoding vs encryption vs hashing

What to use instead

• Storing passwords: hash them with Argon2id, bcrypt or scrypt. Never encrypt or encode passwords.
• Protecting data: encrypt with a vetted library (libsodium, the Web Crypto API, your platform’s KMS) using authenticated encryption such as AES-GCM.
• Transmitting data: use TLS (HTTPS).

Base64 still has a role here: encrypted data and hashes are binary, and Base64 is a great way to store that ciphertext in JSON or a database text column. Just remember the order: encrypt first, then encode.