Base64 encoding is not encryption
Understand Base64 size, UTF-8 text and binary limits before moving encoded data between systems.
Draft prepared: 2026-10-02. Publisher: GXA Technologies. No named expert review is claimed. AI-assisted draft; human editorial review pending
Why bytes are represented as text
Some transport and document formats need binary data represented with a restricted set of text characters. Base64 handles that representation. It does not add a password or secret key, and it does not make the content safe to disclose.
The same byte sequence produces the same standard Base64 representation. A recipient who knows the encoding can reverse it without asking the sender for a decryption key.
The size cost is predictable
Standard Base64 maps each group of three bytes to four characters, adding padding to the final group where required. The encoded character count is 4 × ceil(byteCount / 3), before any wrapping or surrounding document syntax.
The text Hello is five UTF-8 bytes and becomes SGVsbG8=, eight characters. The byte count matters: a non-ASCII character can occupy more than one UTF-8 byte.
Match the receiving protocol
Standard Base64 and URL-safe Base64 use different alphabet choices. A data URL adds a prefix describing its content type. Those details belong to the surrounding protocol, not to a guess that every string is interchangeable.
The current GXA tool encodes text as UTF-8 and files as bytes. Its decode operation displays UTF-8 text, not a reconstructed binary file download. Remove a data-URL prefix before using a plain Base64 decoder.
Validate the kind of round trip you need
For text, compare the decoded characters with the source, including newlines. For a binary integration, compare reconstructed bytes or a trusted hash using software that actually supports binary output.
Do not paste tokens, private documents or credentials just because they look unreadable after encoding. Encoding a secret does not change how it must be protected.
Report an error in this information
Include the page address and the statement that needs checking. Do not send private files or credentials.