Base64 as transport encoding, not secrecy
TextHive turns Unicode text into UTF-8 bytes, then into standard Base64, or reverses the path. The goal is a printable representation for systems that dislike raw binary. Anyone can decode standard Base64; treat it like labeling a box, not locking it.
Useful scenarios
- Embedding a short UTF-8 string where binary is awkward.
- Reading a Base64 sample from documentation back into text.
- Demonstrating encoding vs encryption in a class.
- Checking round-trips for accented or non-Latin characters.
- Inspecting tokens that only look opaque because they are Base64.
Security reminder
Do not execute untrusted decoded content. Decoded text may include HTML, scripts, or shell commands. Encoding a password does not protect it. Prefer proper secret storage and TLS for confidentiality.
Worked example
Text "Hi" → UTF-8 48 69 → Base64 "SGk=" Base64 "SGVsbG8=" → text "Hello"
Padding = matters for the standard alphabet. URL-safe variants differ; this page uses the common alphabet with + and /.
Common mistakes
- Calling Base64 “encrypted” in tickets.
- Pasting decoded markup into an executing console.
- Mixing URL-safe and standard alphabets without translating.
- Pastings of huge binary files into a text box until the tab stalls.
Limits
Text-oriented. No compression, signing, or key derivation. Browser memory bounds apply.
Why UTF-8 first?
Base64 encodes bytes. Characters need a byte serialization; UTF-8 is that step.
Is decode always text?
Bytes may not be valid UTF-8; invalid sequences should error rather than invent characters.
Contact
Send a minimal sample string—never production secrets.
Example expectation
After encode, decode should restore the original when the alphabet and padding are intact.
Encode safely, decode skeptically
Remember Base64 is transport encoding: anyone can reverse it. Never call the output “encrypted” in a ticket. Round-trip a short string with accents or non-Latin characters before trusting a large paste. Prefer the standard alphabet with padding; URL-safe variants need translation if a system expects +/ versus -_.
Do not execute decoded content from untrusted sources—the bytes may be HTML, scripts, or shell. Clear the box after handling staging secrets that happened to be Base64-wrapped. Huge binary dumps can stall a tab; keep samples small when debugging.
Invalid UTF-8 after decode
If bytes are not valid text, expect an error rather than mojibake. Inspect with a hex tool when needed.
Secrets
Encoding a password does not protect it. Use proper secret storage and TLS for confidentiality.
Keep a one-line note of encode versus decode mode with any fixture string you reuse. For query-string escaping, switch to the URL Component Encoder instead of Base64.