Security Fundamentals Practice Question 4: Base64 Is Not Encryption
Security Fundamentals · Test 1 · question 4 of 10
During a code review you find a database password stored in a config file as c3VwZXJzZWNyZXQ=. The developer says: "It's fine, it's Base64-encrypted." What is the problem with this reasoning?
Show answer and explanation
Answer:
It helps to keep three ideas apart:
- Encoding (Base64, hex, URL encoding) changes data into another representation so that it can be transported or stored. It is public and reversible by anyone, with no key. - Encryption is reversible only by someone who holds the key. Its purpose is confidentiality. - Hashing is one-way. You cannot get the input back from the output, which makes it useful for integrity checks and password verification.
RFC 4648, the Base64 standard, says so directly: base encoding visually hides information such as passwords but "does not provide any computational confidentiality" (B). The string above decodes back to plain text in a single command. Secrets like this belong in a secrets manager, or should be genuinely encrypted with the key stored elsewhere.
- A is wrong because Base64 is fully reversible. It is not a hash. - C and D are wrong because Base64 involves no key at all, so it is not a cipher of any kind, weak or strong.
Reference: RFC 4648: The Base16, Base32, and Base64 Data Encodings (Section 12)