Passwords, hashes and Base64 solve different problems
A random password, a file hash and Base64 text can all look like obscure strings. They serve different purposes. Substituting one for another can leave sensitive information exposed.
A password is a secret; encoding is not confidentiality
Choose a long, unpredictable password rather than easily guessed names or dates. A reputable password manager can help generate and store it. Never adopt a published example as a real password.
Base64 turns data into a textual representation that can be decoded without a secret key. RFC 4648 explicitly explains that it provides no confidentiality: an encoded password is still exposed to anyone who decodes it.
References: NCSC — Three Random Words · IETF RFC 4648 — Base Encodings and Security Considerations
What does a hash prove?
A function such as SHA-256 produces a fixed-length digest of data. Comparing it with a trusted reference helps check content equality, but does not certify that a file is safe or that its author is trustworthy.
If the file and its advertised digest come from the same compromised source, both can have been replaced. The reference matters as much as correct arithmetic.
References: MDN — SubtleCrypto digest()
A fast hash is not a password-storage system
Plain general-purpose SHA-256 is not a complete password-storage design. OWASP recommends purpose-built password hashing with appropriate protections. That is a login-system engineering task, not merely running text through a calculator.
Similarly, decoding a JWT does not verify its signature or establish valid access. Do not paste a real credential into support messages just because it looks encoded.
References: OWASP — Password Storage Cheat Sheet · IETF RFC 7519 — Validating JWTs
An example with no secrets
Test becomes VGVzdA== in Base64 and decodes back to Test. Neither direction requires a secret, which is why the encoding cannot hide confidential content.
Adding a newline after Test changes the bytes being hashed. Check encoding and line endings before treating different digests as evidence that a calculator is wrong.