JavaScript's btoa() silently encodes text in Latin-1, not UTF-8, corrupting data

JavaScript's built-in btoa() function processes strings using Latin-1 encoding rather than UTF-8, meaning characters like accented letters produce different base64 output than most systems expect. Characters above U+00FF, such as emoji or CJK script, cause btoa() to throw an error outright, but characters like é silently encode incorrectly without any warning. The real danger lies in decoding: passing correctly encoded UTF-8 base64 through atob() returns garbled mojibake text with no error raised, making the bug easy to miss. Because a system encoding and decoding in the same broken way appears to work correctly, the flaw can persist undetected in codebases for years until data crosses system boundaries. Developers are advised to use TextEncoder to convert text to bytes before encoding, and to initialise TextDecoder with the fatal option so that malformed input throws instead of silently substituting replacement characters.