You open an email that looks like a spam-filter alert. There's a link, and tacked onto the end of it is a chunk of letters and numbers that means nothing to you — no words, no spaces, just a jumble ending in a stray "=". It looks exactly like the kind of thing you're told never to click.
Security researchers documented campaigns doing exactly this in late 2025. Palo Alto's Unit 42 and Malwarebytes both reported phishing emails impersonating internal spam-filter alerts that embed the target's own email address as a base64-encoded parameter in the link, so the fake login page that opens is pre-filled and branded to look personal and legitimate.
That jumbled string wasn't hiding your email address from you, though. It was hiding it from simple automated filters — and anyone willing to decode it can read it as plainly as if it were spelled out.
After this, you'll understand what base64 actually is — a way to represent data using plain text characters, not a cipher — why it shows up constantly in places that have nothing to do with scams, and the one-step habit that turns a mysterious jumble into a plain answer.
Base64 takes any data and represents it using 64 harmless characters — letters, numbers, plus signs, and slashes, often with one or two equal signs padding the end. That's the whole trick. It isn't encryption; nothing is locked or scrambled in a way that requires a key. Anyone, including you, can turn it back into plain text in about one second.
It shows up constantly for entirely ordinary reasons. Email systems use it to attach images and files. Websites use it to embed small icons directly in their code. Apps use it to pass tokens and settings between systems. Seeing base64 somewhere is not, by itself, a warning sign.
What matters is why it's there and what it turns into. In the phishing case above, attackers used it because basic automated filters scan for recognizable patterns — a plain email address, a known bad domain — and a base64 blob doesn't match those patterns on sight. It wasn't hiding anything from a human willing to check. It was hiding from a machine that wasn't checking closely enough.
Base64 doesn't hide anything from you. It only hides from filters that don't bother to look. Decoding it takes one paste and one second.
Base64 has a distinct look once you know it: a run of mixed-case letters and numbers, sometimes with a plus sign or slash mixed in, often ending with one or two "=" characters used as padding. It's longer and more varied-looking than a typical tracking ID, and unlike a password or session token, it isn't random — it's readable data wearing a costume.
You'll most often run into it tacked onto a URL as a parameter value, buried inside an email link like the case above, or sitting in a page's source code. If the rest of the link around it also looks off — an unfamiliar domain, urgent language pushing you to act fast — that's worth a second look with a link checker. The base64 string is only one piece of a suspicious link, not the whole story.
Don't guess what an encoded string means. Decode it. Paste it into a base64 decoder and read what comes back in plain text. Most of the time it's something entirely mundane — your own email address, a tracking ID, a chunk of ordinary text. Occasionally it reveals something worth a closer look, like a raw web address you didn't expect.
Either way, decoding replaces a guess with an answer in about the time it takes to copy and paste. That's the whole habit.
Don't have a string handy? Try this one — it's built from the same kind of thing the phishing example above encoded:
Y3VyaW91c0BuZXd0b3ByaXZhY3kuY29tDrop it into the ZTDev Base64 Encoder/Decoder and watch it turn back into plain text instantly. Once you've seen that one decode, try a base64 string you come across on your own — the trick stops looking like a trick.