In the early years of public AI chatbots, researchers and curious users discovered something surprising: encoding a forbidden request in Base64 was often enough to get a response that a plain-text version of the same request would refuse. The AI would decode the gibberish, understand what was being asked, and answer — apparently without the safety filters triggering.
It sounds almost too simple to be real. But it worked, for a while, and understanding why tells you something important about how AI safety systems are built and where they can break down.
Base64 is an encoding scheme that converts binary data — or any text — into a string of 64 printable ASCII characters. It's used legitimately everywhere: email attachments, embedding images in web pages, passing data through APIs. There's nothing inherently suspicious about it.
The key property relevant here is that Base64 is completely reversible. Given a Base64 string, you can decode it back to the original text perfectly every time. It's not encryption — anyone can decode it — it's just a different representation of the same information.
The phrase "How do I pick a lock?" in Base64 becomes:
To a human, that looks like noise. To a language model that has seen Base64 encoding in its training data, it's transparently readable.
Early AI safety systems relied heavily on pattern matching against known harmful content. A filter trained to block requests about dangerous topics would look for certain keywords and phrases in the input. "How do I pick a lock" might trigger a review. SG93IGRvIEkgcGljayBhIGxvY2s/ looked like random characters and sailed straight through.
The model on the other side, however, had no such blind spot. Large language models are trained on enormous amounts of text from the internet, which includes documentation, tutorials, and discussions about encoding. Decoding Base64 is exactly the kind of task they're good at. So the model would decode the input, understand the request in full, and respond — while the safety layer upstream had seen nothing unusual.
As ChatGPT and similar models became publicly available, AI researchers and hobbyists began systematically testing where the safety guardrails could be bypassed. Encoding tricks — Base64, ROT13, pig latin, morse code — were among the first categories explored.
Working jailbreaks spread quickly through Reddit, Discord servers, and AI-focused forums. Base64 encoding was particularly popular because it was easy — anyone could encode a prompt with a free online tool and paste the result into a chatbot.
AI safety researchers began formally documenting encoding-based bypasses as a category of prompt injection. Papers and blog posts described the pattern in detail, which simultaneously informed defenders and made the techniques more widely known.
The major AI companies responded by updating their models and filters to decode and inspect encoded inputs before applying safety checks. Basic Base64 jailbreaks stopped working reliably against the leading consumer models within a relatively short period.
Base64 got the most attention because it's widely known and easy to use, but it was one technique in a broader category of obfuscation-based bypasses. Researchers documented similar effects with:
All of these exploited the same fundamental gap: a filter looking at surface-level text patterns, and a model capable of understanding the meaning beneath those patterns.
The Base64 episode is interesting beyond the specific bypass because it illustrates a structural problem in AI safety design. Layering a text-pattern filter on top of a model that understands encoding creates a mismatch. The filter sees one thing; the model processes another.
This is the same fundamental issue behind prompt injection attacks on AI-powered applications — where malicious instructions are hidden in documents, emails, or web pages that an AI is asked to read and process. The AI faithfully follows the hidden instructions because it understands them, even if the application developer never intended for those instructions to be there.
The Base64 jailbreak era ended fairly quickly for consumer products, but it left a lasting mark on how AI safety is discussed and designed. It demonstrated that safety can't be bolted on as a text filter after the fact — it needs to be integrated into the model's understanding of what it should and shouldn't do. That shift toward training models to refuse harmful requests based on understanding rather than pattern matching is a significant part of why modern AI safety research looks the way it does.
It also introduced the wider public to the concept of prompt injection — the idea that the text fed to an AI model is a kind of input that can be crafted to manipulate behavior, the same way SQL injection manipulates databases or buffer overflows manipulate program execution. That framing has proved durable and useful.
Convert text to Base64 or decode Base64 back to plain text. Runs entirely in your browser — nothing is sent to any server.
Open Base64 Tool