Base64 turns arbitrary text into a compact alphabet that survives transport through systems that mangle special characters, such as HTTP headers, URLs and email. One thing to be completely clear about: this is encoding, not encryption. Anyone can decode it instantly, and it provides no security whatsoever.
No, and treating it that way is a real security mistake. Base64 is a reversible public transformation with no key involved. Anyone who sees the string can decode it in seconds. Use proper encryption for anything that genuinely needs protecting.
Yes. The text is encoded as UTF-8 before Base64 is applied, so accented characters, non-Latin scripts and emoji all round-trip correctly.
Embedding binary in text-only formats: HTTP basic auth headers, email attachments, data URIs, JSON payloads carrying binary, and configuration files that must remain plain text.
That is padding. Base64 works in three-byte groups, so when the input length is not divisible by three, one or two equals signs mark the shortfall.