What is the Java 8 Base64 API?

• Base64 converts binary data into ASCII text using 64 printable characters, making binary content safe for text-based transport like JSON and HTTP headers.
• Basic encoder uses the standard alphabet (A-Z, a-z, 0-9, +, /) and is suitable for general encoding.
• URL-safe encoder replaces + and / with - and _ so the string survives URL parsing without percent-encoding.
• MIME encoder inserts line breaks every 76 characters per the MIME standard, suitable for email attachments.
• Encoding is NOT encryption: anyone can decode Base64 without any key, so it provides zero confidentiality.
• Size overhead: Base64 increases data size by approximately 33 percent because every 3 input bytes produce 4 output characters.

What is the Java 8 Base64 API?

Java 8 introduced java.util.Base64 as a standard API for encoding and decoding binary data to and from ASCII text. Before Java 8, developers used the unofficial sun.misc.BASE64Encoder which was not part of the public API and could break between JDK versions.

How do you use Base64 encoding and decoding?

package com.bank.service;

import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class Base64Demo {
    public static void main(String[] args) {
        String accountData = "SAV2001:Rajesh:125000.00";
        byte[] originalBytes = accountData.getBytes(StandardCharsets.UTF_8);

        // Encode
        String encoded = Base64.getEncoder().encodeToString(originalBytes);
        System.out.println("Encoded: " + encoded);

        // Decode
        byte[] decodedBytes = Base64.getDecoder().decode(encoded);
        String decoded = new String(decodedBytes, StandardCharsets.UTF_8);
        System.out.println("Decoded: " + decoded);
    }
}

Encoded: U0FWMjAwMTpSYWplc2g6MTI1MDAwLjAw
Decoded: SAV2001:Rajesh:125000.00

How is URL-safe encoding different from Basic?

| Aspect | Basic | URL-safe |
|--------|-------|----------|
| Characters | A-Z, a-z, 0-9, +, / | A-Z, a-z, 0-9, -, _ |
| Padding | = padding by default | Optional (withoutPadding) |
| Safe in URLs | No (+ and / need escaping) | Yes (- and _ are URL-safe) |
| Use case | General encoding | JWT tokens, URL parameters |

package com.bank.service;

import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class UrlSafeBase64Demo {
    public static void main(String[] args) {
        String token = "txn-id:TXN20240115:amount:50000";
        byte[] bytes = token.getBytes(StandardCharsets.UTF_8);

        String basic = Base64.getEncoder().encodeToString(bytes);
        String urlSafe = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);

        System.out.println("Basic:    " + basic);
        System.out.println("URL-safe: " + urlSafe);
    }
}

Why is Base64 encoding NOT encryption?

package com.bank.core;

import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class EncodingVsEncryption {
    public static void main(String[] args) {
        String secret = "AccountNumber:1234567890";

        // Base64 encoding: ANYONE can decode this!
        String encoded = Base64.getEncoder().encodeToString(
            secret.getBytes(StandardCharsets.UTF_8));
        System.out.println("Encoded: " + encoded);

        // Anyone can decode without any key:
        String decoded = new String(
            Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8);
        System.out.println("Decoded: " + decoded);
        // Zero security! Never Base64-encode sensitive data and call it protected.
    }
}

Encoded: QWNjb3VudE51bWJlcjoxMjM0NTY3ODkw
Decoded: AccountNumber:1234567890

What are the common banking use cases for Base64?

Base64 is used in banking systems for embedding HMAC signatures in JSON API payloads, encoding KYC documents (images, PDFs) for transmission in REST API responses, encoding JWT header and payload sections, and encoding binary content in XML SOAP messages. In each case, Base64 makes binary data text-safe for transport but provides no security.

What are the limitations?

Base64 inflates data size by approximately 33 percent. Three bytes of binary data become four Base64 characters. For large files like KYC document scans, this overhead matters. Avoid Base64-encoding large blobs in performance-critical paths. Use multipart form data or presigned URLs instead.

What should a senior engineer know?

JWT tokens use Base64URL encoding for the header and payload, which means anyone can decode and read them. Sensitive data like account numbers should never be stored in JWT payloads. Only the JWT signature provides integrity through HMAC with a secret key. For confidentiality, use JWE (JSON Web Encryption) rather than plain JWT.

What about MIME encoding?

MIME encoding inserts line breaks every 76 characters per the RFC 2045 standard. Use it when embedding encoded content in email bodies or multipart MIME messages. The bank's statement delivery service uses MIME encoding when attaching PDF statements to email notifications.

When should you NOT use Base64?

Do not Base64-encode data and claim it is protected. Do not use Base64 for large binary payloads in hot API paths because the 33 percent overhead adds latency and memory pressure. Do not use the unofficial sun.misc.BASE64Encoder: use java.util.Base64 from Java 8 onward.