What Is Base64?
Base64 is an encoding scheme, not encryption. It converts binary data into a text-safe format by representing 8-bit bytes as 6-bit groups, mapped to 64 printable ASCII characters.
The key point: anyone with a Base64 string can decode it instantly without a key. It's used for transport safety (text-only protocols), not secrecy. If you need secrecy, use encryption (AES, RSA) before Base64.
Base64 vs Base64url
Base64 uses + and /, which have special meanings in URLs and MIME.
Base64url (RFC 4648) replaces them with - and _ for safe URL embedding. JWT tokens use Base64url for the header and payload sections.
Real-World Use Cases
🔐 JWT Token Decoding
Inspect claims (user ID, roles, expiry) without pasting into jwt.io or third-party sites.
Read guide →⚙️ Kubernetes Secrets
Encode raw values for Secret data: fields. Decode existing secrets to debug.
🔑 HTTP Basic Auth
Combine username and password: user:pass → Base64 → Authorization header.
Why Never Use Online Tools (Even "Secure" Ones)
- Data in transit: HTTPS doesn't matter if the site logs your input.
- Logs on the server: Many "temporary" tools keep request logs for debugging or analytics.
- Browser caching: Your API key might be in your browser history or cache.
- Zero-knowledge ≠ secure: Even zero-knowledge claims can't be verified from outside.
Use a local tool instead. TextForge runs entirely in your browser—your data never leaves your machine.
Quick Reference: Common Operations
Encode a string
Output: aGVsbG8=
Decode a JWT header
→
{"alg":"HS256","typ":"JWT"}
Encode for Kubernetes Secret
Output: bXktc2VjcmV0LXBhc3N3b3Jk
In Secret YAML:
data:
password: bXktc2VjcmV0LXBhc3N3b3Jk
Encode for Basic Auth
Output: YWRtaW46bXlwYXNzd29yZA==
In HTTP header:
Authorization: Basic YWRtaW46bXlwYXNzd29yZA==
Privacy-First Encoding
TextForge is a free Chrome extension that encodes and decodes Base64 locally in your browser:
- ✅ No account, no signup
- ✅ No data sent to any server
- ✅ Works offline
- ✅ Supports Base64 and Base64url
- ✅ 50+ other text tools included (regex, JSON, sort, extract, etc.)
Remember: Base64 is encoding, not encryption. Always assume a Base64 string can be decoded by anyone. If you're encoding sensitive data (passwords, API keys, tokens), encrypt it first, then Base64-encode the ciphertext for transport.