Base64 Is Not Encryption
Encoding changes the representation; encryption changes who can read it. Confusing the two is the most common security mistake in web apps.
2026-10-12 · Encode
Anyone can decode it
Base64 exists to carry binary through text channels. There is no key — treat a Base64 string exactly like the plaintext behind it.
URL encoding is not sanitisation
Percent-encoding makes a value safe inside a URL, not safe in a database or an HTML page.
Hashing is not encryption either
A hash cannot be reversed, which makes it right for integrity and wrong for anything you need to read back.
Can Base64 hide an API key?
No. It is trivially decoded — keep secrets server-side.
Is Base64 larger?
About 33% larger: 3 bytes become 4 characters.