What base64 is actually for
Base64 exists to let data that is not text travel through a channel built only to carry text — an email body, a JSON field, a data URL sitting inside a stylesheet. The Base64-Encoder/-Decoder represents that data using sixty-four printable characters chosen specifically because every one of them survives untouched through systems that would otherwise mangle raw bytes.
An encoding, not a form of protection
The transformation is entirely public and reversible by anyone, with no key involved anywhere in the process. A password or an API key stored as base64 is not hidden in any meaningful sense — it is stored in plain sight, one decode away from being read by whoever finds it.
The output is always about a third larger
Every three bytes of input become four characters of output, which is a fixed, inherent property of the format rather than something that varies by content. That growth matters most for data URLs: inlining a large image as base64 can leave the surrounding stylesheet or document bigger than the original file it was meant to replace.
Text survives the round trip because of an extra step
Text is converted to UTF-8 bytes before encoding and converted back afterwards, which is what lets accented characters, other scripts and emoji come back exactly as they went in rather than arriving mangled. The encoding itself only ever deals in bytes; the UTF-8 conversion is what connects it back to readable text.
The URL-safe variant is a genuinely different alphabet
Tokens and URL parameters commonly use a variant where dash and underscore replace the plus and slash that standard base64 uses, specifically because plus and slash have their own meaning inside a URL. A string encoded that way will not decode correctly here without converting those characters back to the standard alphabet first.
Whitespace tolerance versus a truncated string
Many systems wrap long base64 output at a fixed line width, and those line breaks are generally tolerated when pasted back in for decoding. A string that has been cut off partway through is a different problem entirely — decoding can only work on what is actually complete.
