diff --git a/Cargo.lock b/Cargo.lock
index abdf98f9ad3d..bb6d8153843c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -123,6 +123,12 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
+[[package]]
+name = "base64"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
+
 [[package]]
 name = "base64ct"
 version = "1.5.3"
@@ -1913,7 +1919,7 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0864aeff53f8c05aa08d86e5ef839d3dfcf07aeba2db32f12db0ef716e87bd55"
 dependencies = [
- "base64",
+ "base64 0.13.1",
 ]
 
 [[package]]
@@ -2092,7 +2098,7 @@ dependencies = [
  "aes",
  "arc-swap",
  "async-trait",
- "base64",
+ "base64 0.21.0",
  "blake3",
  "bloomfilter",
  "byte_string",
@@ -2150,7 +2156,7 @@ dependencies = [
 name = "shadowsocks-rust"
 version = "1.15.2"
 dependencies = [
- "base64",
+ "base64 0.21.0",
  "build-time",
  "byte_string",
  "byteorder",
@@ -2188,7 +2194,7 @@ version = "1.15.2"
 dependencies = [
  "arc-swap",
  "async-trait",
- "base64",
+ "base64 0.21.0",
  "byte_string",
  "byteorder",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index ee984e98fcc9..5d638718e7ba 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -142,7 +142,7 @@ log4rs = { version = "1.2", optional = true }
 serde = { version = "1.0", features = ["derive"] }
 json5 = "0.4"
 thiserror = "1.0"
-base64 = "0.13"
+base64 = "0.21"
 
 clap = { version = "4.0", features = ["wrap_help", "suggestions"] }
 cfg-if = "1"
diff --git a/crates/shadowsocks-service/Cargo.toml b/crates/shadowsocks-service/Cargo.toml
index d5d5daada48c..acce12a74ecd 100644
--- a/crates/shadowsocks-service/Cargo.toml
+++ b/crates/shadowsocks-service/Cargo.toml
@@ -120,7 +120,7 @@ smoltcp = { version = "0.8", optional = true, default-features = false, features
 
 serde = { version = "1.0", features = ["derive"] }
 json5 = "0.4"
-base64 = "0.13"
+base64 = "0.21"
 
 shadowsocks = { version = "1.15.0", path = "../shadowsocks", default-features = false }
 
diff --git a/crates/shadowsocks-service/src/config.rs b/crates/shadowsocks-service/src/config.rs
index c01a37a273e3..892cef258138 100644
--- a/crates/shadowsocks-service/src/config.rs
+++ b/crates/shadowsocks-service/src/config.rs
@@ -41,6 +41,7 @@
 //!
 //! These defined server will be used with a load balancing algorithm.
 
+use base64::Engine as _;
 use std::{
     borrow::Cow,
     convert::{From, Infallible},
@@ -66,7 +67,14 @@ use serde::{Deserialize, Serialize};
 use shadowsocks::relay::socks5::Address;
 use shadowsocks::{
     config::{
-        ManagerAddr, Mode, ReplayAttackPolicy, ServerAddr, ServerConfig, ServerUser, ServerUserManager, ServerWeight,
+        ManagerAddr,
+        Mode,
+        ReplayAttackPolicy,
+        ServerAddr,
+        ServerConfig,
+        ServerUser,
+        ServerUserManager,
+        ServerWeight,
     },
     crypto::CipherKind,
     plugin::PluginConfig,
@@ -1709,7 +1717,7 @@ impl Config {
                     let mut user_manager = ServerUserManager::new();
 
                     for user in users {
-                        let key = match base64::decode_config(&user.password, base64::STANDARD) {
+                        let key = match base64::engine::general_purpose::STANDARD.decode(&user.password) {
                             Ok(k) => k,
                             Err(..) => {
                                 let err = Error::new(
@@ -2480,7 +2488,7 @@ impl fmt::Display for Config {
                             for u in m.users_iter() {
                                 vu.push(SSServerUserConfig {
                                     name: u.name().to_owned(),
-                                    password: base64::encode(u.key()),
+                                    password: base64::engine::general_purpose::STANDARD.encode(u.key()),
                                 });
                             }
                             vu
diff --git a/crates/shadowsocks-service/src/manager/server.rs b/crates/shadowsocks-service/src/manager/server.rs
index 0d0558d65111..ad0ac69f2f61 100644
--- a/crates/shadowsocks-service/src/manager/server.rs
+++ b/crates/shadowsocks-service/src/manager/server.rs
@@ -1,9 +1,12 @@
 //! Shadowsocks Manager server
 
+use base64::Engine as _;
+
 #[cfg(unix)]
 use std::path::PathBuf;
 use std::{collections::HashMap, io, net::SocketAddr, sync::Arc, time::Duration};
 
+use base64::engine::general_purpose::STANDARD;
 use log::{error, info, trace};
 use shadowsocks::{
     config::{Mode, ServerConfig, ServerType, ServerUser, ServerUserManager},
@@ -469,7 +472,7 @@ impl Manager {
             let mut user_manager = ServerUserManager::new();
 
             for user in users.iter() {
-                let key = match base64::decode_config(&user.password, base64::STANDARD) {
+                let key = match STANDARD.decode(&user.password) {
                     Ok(key) => key,
                     Err(..) => {
                         error!(
@@ -522,7 +525,7 @@ impl Manager {
                 for user in user_manager.users_iter() {
                     vu.push(ServerUserConfig {
                         name: user.name().to_owned(),
-                        password: base64::encode(user.key()),
+                        password: STANDARD.encode(user.key()),
                     });
                 }
 
diff --git a/crates/shadowsocks/Cargo.toml b/crates/shadowsocks/Cargo.toml
index 8ff7b6d79381..ebe9bb4bdb13 100644
--- a/crates/shadowsocks/Cargo.toml
+++ b/crates/shadowsocks/Cargo.toml
@@ -46,7 +46,7 @@ libc = "0.2.94"
 bytes = "1.2"
 cfg-if = "1"
 byte_string = "1.0"
-base64 = "0.13"
+base64 = "0.21"
 url = "2.2"
 once_cell = "1.17"
 spin = { version = "0.9", features = ["std"] }
diff --git a/crates/shadowsocks/src/config.rs b/crates/shadowsocks/src/config.rs
index 78c626f8e118..536b46b0e939 100644
--- a/crates/shadowsocks/src/config.rs
+++ b/crates/shadowsocks/src/config.rs
@@ -12,7 +12,10 @@ use std::{
     time::Duration,
 };
 
-use base64::{decode_config, encode_config, URL_SAFE, URL_SAFE_NO_PAD};
+use base64::{
+    engine::general_purpose::{STANDARD, URL_SAFE, URL_SAFE_NO_PAD},
+    Engine as _,
+};
 use byte_string::ByteStr;
 use bytes::Bytes;
 use cfg_if::cfg_if;
@@ -161,7 +164,7 @@ impl Debug for ServerUser {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         f.debug_struct("ServerUser")
             .field("name", &self.name)
-            .field("key", &base64::encode(&self.key))
+            .field("key", &STANDARD.encode(&self.key))
             .field("identity_hash", &ByteStr::new(&self.identity_hash))
             .finish()
     }
@@ -302,7 +305,7 @@ pub struct ServerConfig {
 fn make_derived_key(method: CipherKind, password: &str, enc_key: &mut [u8]) {
     if method.is_aead_2022() {
         // AEAD 2022 password is a base64 form of enc_key
-        match base64::decode_config(password, base64::STANDARD) {
+        match STANDARD.decode(password) {
             Ok(v) => {
                 if v.len() != enc_key.len() {
                     panic!(
@@ -363,7 +366,7 @@ where
         make_derived_key(method, upsk, &mut enc_key);
 
         for ipsk in split_iter {
-            match base64::decode_config(ipsk, base64::STANDARD) {
+            match STANDARD.decode(ipsk) {
                 Ok(v) => {
                     identity_keys.push(Bytes::from(v));
                 }
@@ -564,7 +567,7 @@ impl ServerConfig {
     /// ```
     pub fn to_qrcode_url(&self) -> String {
         let param = format!("{}:{}@{}", self.method(), self.password(), self.addr());
-        format!("ss://{}", encode_config(param, URL_SAFE_NO_PAD))
+        format!("ss://{}", URL_SAFE_NO_PAD.encode(param))
     }
 
     /// Get [SIP002](https://github.com/shadowsocks/shadowsocks-org/issues/27) URL
@@ -573,13 +576,13 @@ impl ServerConfig {
             if #[cfg(feature = "aead-cipher-2022")] {
                 let user_info = if !self.method().is_aead_2022() {
                     let user_info = format!("{}:{}", self.method(), self.password());
-                    encode_config(&user_info, URL_SAFE_NO_PAD)
+                    URL_SAFE_NO_PAD.encode(&user_info)
                 } else {
                     format!("{}:{}", self.method(), percent_encoding::utf8_percent_encode(self.password(), percent_encoding::NON_ALPHANUMERIC))
                 };
             } else {
                 let mut user_info = format!("{}:{}", self.method(), self.password());
-                user_info = encode_config(&user_info, URL_SAFE_NO_PAD)
+                user_info = URL_SAFE_NO_PAD.encode(&user_info)
             }
         }
 
@@ -629,7 +632,7 @@ impl ServerConfig {
                 None => return Err(UrlParseError::MissingHost),
             };
 
-            let mut decoded_body = match decode_config(encoded, URL_SAFE_NO_PAD) {
+            let mut decoded_body = match URL_SAFE_NO_PAD.decode(encoded) {
                 Ok(b) => match String::from_utf8(b) {
                     Ok(b) => b,
                     Err(..) => return Err(UrlParseError::InvalidServerAddr),
@@ -690,7 +693,7 @@ impl ServerConfig {
                     URL_SAFE_NO_PAD
                 };
 
-                let account = match decode_config(decoded_user_info, base64_config) {
+                let account = match base64_config.decode(decoded_user_info) {
                     Ok(account) => match String::from_utf8(account) {
                         Ok(ac) => ac,
                         Err(..) => return Err(UrlParseError::InvalidAuthInfo),
diff --git a/src/service/genkey.rs b/src/service/genkey.rs
index 1be4ba1b00d8..a28eaa2b8f31 100644
--- a/src/service/genkey.rs
+++ b/src/service/genkey.rs
@@ -2,6 +2,7 @@
 
 use std::process::ExitCode;
 
+use base64::Engine as _;
 use clap::{builder::PossibleValuesParser, Arg, ArgAction, ArgMatches, Command};
 use rand::RngCore;
 
@@ -36,7 +37,7 @@ pub fn main(matches: &ArgMatches) -> ExitCode {
         let mut rng = rand::thread_rng();
         rng.fill_bytes(&mut key);
 
-        let encoded_key = base64::encode(&key);
+        let encoded_key = base64::engine::general_purpose::STANDARD.encode(&key);
         println!("{encoded_key}");
     }