A string like cGFzc3dvcmQxMjM= looks scrambled enough that people treat it as safe. It isn't. Base64 is an encoding — a reversible way to write binary data using 64 printable characters — and anyone can turn it back into the original in one step, no key required. Confusing that reversibility for secrecy is behind a surprising number of real leaks, so it's worth being precise about what the two words actually mean.
Encoding versus encryption, in one sentence each
Encoding changes the form of data so it survives a channel that only accepts certain characters — that's Base64's whole job, and the rules are public, so decoding is deterministic. Encryption changes the meaning of data so that reversing it requires a secret, and without that secret the output is useless. The tell is the key: if no key was involved, nothing was protected.
How to recognise Base64 on sight
It uses only A–Z, a–z, 0–9, and the two characters + and /, often with one or two = signs padding the end. Its length is always a multiple of four. If you can see those traits, you're looking at reversible encoding, not a cipher — and you can confirm it by decoding it and reading plain text back out. Real encrypted data, by contrast, looks like uniform random bytes with no padding pattern and decodes to nothing legible.
Where the confusion actually causes damage
The classic case is a credential stored or transmitted as Base64 and assumed to be hidden — a Basic Auth header, an API token dropped into a cookie, a password "obfuscated" in a config file. None of those are protected; they're just written in a different alphabet. Anyone who can read the encoded value can read the secret, which is why "we Base64 it before sending" is never an answer to "is it secure?" If a value needs to stay secret in transit, that's what HTTPS is for; if it needs to stay secret at rest, that's what encryption with a managed key is for.
When Base64 is exactly the right tool
Encoding earns its place whenever binary data has to ride through a text-only path: embedding a small image directly in CSS or HTML as a data URI, attaching a file in an email, or putting a binary blob inside a JSON field that can't hold raw bytes. In all of those, you want it to be trivially reversible — the recipient has to decode it. Used for that, it's doing its job perfectly; the only mistake is asking it to keep a secret it was never built to keep.