JWT — JSON Web Tokens
JWT headers and payloads are Base64url-encoded. A JWT consists of three dot-separated parts: header.payload.signature. Decoding the first two reveals the algorithm and claims as plain JSON. This is fundamental to OAuth 2.0, OpenID Connect, and modern REST API authentication. Critical note: JWT payloads are only encoded, not encrypted — anyone with the token can read the payload.
HTTP Basic Authentication
The HTTP Basic Auth scheme encodes username:password as Base64 in the Authorization header. This must always be used over HTTPS since Base64 is trivially reversible.
Data URIs and Inline Assets
Embedding small binary files in HTML eliminates HTTP requests: <img src="data:image/png;base64,...">. Best reserved for assets under 10 KB since Base64 inflates file size by ~33%.
Email MIME Attachments
SMTP was designed for 7-bit ASCII text. Base64 allows binary files — images, PDFs, ZIP archives — to pass through email infrastructure unchanged via Content-Transfer-Encoding: base64.
API Payloads and Secrets
REST APIs embed binary content (TLS certificates, SSH keys) as Base64 strings within JSON. Kubernetes, Docker, and CI/CD platforms store Base64-encoded secrets in YAML and environment variables to handle special characters safely.
Base64 Is Not Encryption
Base64 provides zero confidentiality. Anyone can decode it in milliseconds. Never use Base64 to hide passwords, API keys, or personal data. For real security use AES-256-GCM or ChaCha20-Poly1305. For passwords, use bcrypt, scrypt, or Argon2.
Privacy
All operations run entirely in your browser. No input is ever sent to any server.
Comments