Base64: not encryption

One shape passes through a prism and comes out the other side as the same shape, just coloured differently.

Say someone sends you SGV5LCBnZWhlaW0h. That looks like a code. It is a code — but there's no key, no password, no secret. Anyone can undo it in one click. This is the difference between writing it differently and actually hiding it, and that difference is why this chapter comes first.

Words you might need

Byte: Everything in a computer — a letter, a pixel, a note in a song — is ultimately a number from 0 to 255. That number is called a byte. The letter A is byte 65, a space is 32.
Encode: Writing down the same information in a different way. Like "five" and "5" and "V" being the same number. Nothing is lost and nothing is hidden.
Base64: A way to write down bytes using only letters, digits, + and /. Every three bytes become four characters. That's why everything gets a third longer.
Hexadecimal: Another way to write down bytes, this time with the digits 0–9 and the letters a–f. Every byte becomes two characters: 41 is the letter A. You'll see this in the demo shortly.

So why does it exist?

In the past, email programs could only send plain text. If you attached a photo, it arrived broken on the other end, because it contained bytes the mail server didn't understand. The fix: turn those bytes into characters every program does understand, and reverse it on the other side. That's base64. It's still everywhere today: in the photo on your ID card when it's read out, in the tokens that keep you logged into a website, in certificates.

Try it yourself

Everything happens in your browser. Nothing is sent to the server.

Click To base64. You'll see your sentence as bytes and as base64.
Paste the base64 result into the box and click Back to text. Your sentence comes back. No password.
Now paste SGV5LCBnZWhlaW0h and click Back to text.

Text or base64

Look at the Bytes (hex) line. Those are the real numbers your sentence is made of. Base64 and hexadecimal are both just ways of writing down those numbers — like you can write a number in digits or in words. Neither one hides anything.

The test you can always run from now on

See something that looks unreadable? Ask yourself one question: do you need a key to reverse it? No? Then it's encoding, and it isn't secret, no matter how strange it looks. Yes? Only then is it encryption. Everything that follows on this site is about that "yes".

Know those "tokens" from websites? When you're logged in, your browser often stores a long string of characters with two dots in it. That's a JWT, and the first two parts are just base64. Anyone can read what's in it — your name, your user number. What no one can fake is the third part: the signature. You'll see how that works in chapter seven.

This is math: counting in a different base

You count in tens: 10 digits, from 0 to 9. A computer counts in twos: 0 and 1. Hexadecimal counts in sixteens, base64 in sixty-fours. It's all the same number, just written differently. The question "how many characters do you need to write down a number?" is a matter of logarithms — and that's exactly why 3 bytes always become 4 base64 characters: 2²⁴ = 64⁴. Check it yourself.