A developer implements an API endpoint that accepts Basic Authentication. The credentials are 'admin:password' encoded as Base64. An analyst asks why Base64 is not encryption. What is the correct explanation?

• A.Base64 is an encoding scheme (not encryption) that represents binary data in ASCII text format. It has no key and is trivially reversible by anyone: 'admin:password' → 'YWRtaW46cGFzc3dvcmQ=' → 'admin:password'. Encryption requires a key and produces ciphertext that cannot be reversed without the key. Basic Auth credentials encoded in Base64 are effectively plaintext without TLS
• B.Base64 uses AES-128 encryption with a fixed key
• C.Base64 encoding is secure because it changes the character encoding
• D.Base64 is a form of encryption using a public key; the resource owner password credentials grant is the current best practice for first-party mobile apps under OAuth 2.1; HTTP Basic authentication encrypts credentials with the server's public key before transmission; WebAuthn credentials are portable text secrets, and a phished user can be tricked into typing one into a fake site; a password manager increases risk because autofill types credentials into any origin that asks, ignoring the saved domain