Base64 is not encryption

Base64 exists because some channels are happier with a small set of letters than with raw bytes. Email bodies, JSON fields, and data URLs are common examples. The encoder takes bytes and writes them using A–Z, a–z, 0–9, plus, and slash, with equals signs for padding. The decoder reverses that writing. There is no password and no key.

Encryption is a different job. It transforms data so that someone without the secret should not be able to read it. Base64 does the opposite of hiding: it makes the bytes easy to copy as text. If you can see the string, you can decode it. The Base64 tool on this site will do that in the tab, without sending the text anywhere.

A useful check is round-trip. Encode a short sentence, then decode the result. You should get the same sentence back, including spaces and punctuation. If decode fails, the string is not valid Base64: the length after removing spaces may not be a multiple of four, or a character outside the alphabet slipped in. The tool reports that instead of guessing.

People sometimes paste a token that looks like Base64 and assume it is “secure.” Many tokens are Base64 (or Base64URL) wrappers around JSON or random bytes. The wrapping is for transport. The security, if any, comes from a signature or from a secret stored elsewhere — not from the alphabet.

This page encodes and decodes Unicode text as UTF-8. That is the right default for notes and snippets. It is not a general binary file locker, and it will not open an encrypted archive. If you need confidentiality, use a tool designed for encryption and keep the key off the page.

In short: Base64 changes how bytes are written. It does not change who can read them. Treat a Base64 string as public as soon as it leaves your machine, the same way you would treat the original text.