Base64: not encryption

One shape passes through a prism and comes out the other side as the same shape, just coloured differently.

Say someone sends you SGV5LCBnZWhlaW0h. That looks like a code. It is a code — but there's no key, no password, no secret. Anyone can undo it in one click. This is the difference between writing it differently and actually hiding it, and that difference is why this chapter comes first.

Words you might need

Byte: Everything in a computer — a letter, a pixel, a note in a song — is ultimately a number from 0 to 255. That number is called a byte. The letter A is byte 65, a space is 32.
Encode: Writing down the same information in a different way. Like "five" and "5" and "V" being the same number. Nothing is lost and nothing is hidden.
Base64: A way to write down bytes using only letters, digits, + and /. Every three bytes become four characters. That's why everything gets a third longer. In a web address a variant with - and _ is used, because + and / already mean something else there.
Hexadecimal: Another way to write down bytes, this time with the digits 0–9 and the letters a–f. Every byte becomes two characters: 41 is the letter A. You'll see this in the demo shortly.

So why does it exist?

In the past, email programs could only send plain text. If you attached a photo, it arrived broken on the other end, because it contained bytes the mail server didn't understand. The fix: turn those bytes into characters every program does understand, and reverse it on the other side. That's base64.

And that's exactly where its use lies. Anything on a computer can be put into base64: a photo, a song, a PDF, a whole program. What comes out is ordinary text — letters, digits and a couple of punctuation marks, nothing more. And text you can put anywhere.

In a web address. As an attachment to an email. In a message you just select, copy and paste somewhere else. Nothing breaks on the way, because no program is going to fiddle with an A or a 7. With raw bytes it does go wrong: one line ending converted along the way, or one byte read as "the file stops here", and your photo is beyond repair. That's the whole trade-off — your file gets a third longer, and in return it survives every journey.

That's why it's still everywhere today: in the photo on your ID card when it's read out, in the keys you're about to make yourself, and in every attachment you send with an email.

Try it yourself

Everything happens in your browser. Nothing is sent to the server.

Click To base64. You'll see your sentence as bytes and as base64.
Paste the base64 result into the box and click Back to text. Your sentence comes back. No password.
Now paste SGV5LCBnZWhlaW0h and click Back to text.

Text or base64

Look at the Bytes (hex) line. Those are the real numbers your sentence is made of. Base64 and hexadecimal are both just ways of writing down those numbers — like you can write a number in digits or in words. Neither one hides anything.

The test you can always run from now on

See something that looks unreadable? Ask yourself one question: do you need a key to reverse it? No? Then it's encoding, and it isn't secret, no matter how strange it looks. Yes? Only then is it encryption. Everything that follows on this site is about that "yes".

You'll keep seeing this across the whole site. Almost every chapter from here on shows its result in base64: the encrypted packet in chapter 4, your public key in chapter 6, the message you send over WhatsApp in chapter 8.1, your ID photo when you pull it out of the chip in chapter 8.2. Every time for the reason above: bytes have to travel through something that only handles text. And every time the same rule — what's secret is in the bytes. Never in the base64 around them.

This is math: counting in a different base

You count in tens: 10 digits, from 0 to 9. A computer counts in twos: 0 and 1. Hexadecimal counts in sixteens, base64 in sixty-fours. It's all the same number, just written differently. The question "how many characters do you need to write down a number?" is a matter of logarithms — and that's exactly why 3 bytes always become 4 base64 characters: 2²⁴ = 64⁴. Check it yourself.