What is Base64 Encoding?

A complete explanation of how Base64 works, why it exists, and when to use it.

The Short Answer

Base64 is a way to represent binary data (bytes) as plain text. It converts any sequence of bytes into a string made of only 64 printable characters: A–Z, a–z, 0–9, +, and /.

You'll encounter it constantly in software development: in JWTs, data URIs, email attachments, API keys, and config files. It's one of those fundamentals that's worth understanding properly.

Why Does Base64 Exist?

In the early days of the internet, many protocols (like email/SMTP) were designed to only handle 7-bit ASCII text. They couldn't reliably transmit arbitrary binary data — a byte with value 0x00 (null) or 0xFF could corrupt or terminate the transfer.

Base64 solved this by encoding binary data into a safe subset of ASCII characters that every system could handle without modification. Today it's used even in modern contexts for the same reason: text-based formats like JSON, XML, and HTML can't embed raw binary safely.

How Base64 Encoding Works

Base64 works by processing input data in 3-byte groups (24 bits) and encoding each group as 4 Base64 characters (6 bits each):

1. Take 3 bytes of input (24 bits)
2. Split into 4 groups of 6 bits
3. Map each 6-bit value (0–63) to one of the 64 printable characters
4. If the input isn't divisible by 3, add = padding

This is why Base64 output is always approximately 33% larger than the original: 3 bytes become 4 characters.

Base64 vs URL-Safe Base64

Standard Base64 uses + and /, which have special meaning in URLs. URL-safe Base64 (defined in RFC 4648) replaces them:

• + → -
• / → _

JWTs (JSON Web Tokens) use URL-safe Base64. When decoding a JWT payload, make sure you use a URL-safe decoder or replace - and _ back before decoding.

Common Use Cases

• Data URIs: Embed images directly in HTML/CSS — src="data:image/png;base64,iVBOR..."
• JWT tokens: The header and payload sections of a JWT are Base64URL-encoded JSON objects
• HTTP Basic Auth: Credentials are sent as Authorization: Basic base64(username:password)
• Email attachments: MIME encoding wraps binary attachments in Base64 for SMTP transport
• Kubernetes secrets: Secret values in Kubernetes manifests are stored as Base64 strings
• API keys & tokens: Many services issue Base64-encoded credentials

What Base64 is NOT

This is the most important thing to understand:

• Not encryption: Base64 is trivially reversible. Anyone can decode it in seconds. Never use it to "hide" or "protect" sensitive data.
• Not compression: Base64 makes data ~33% larger, not smaller.
• Not hashing: Unlike MD5 or SHA256, Base64 is fully reversible — it's encoding, not a one-way function.

Quick Reference: Code Examples

JavaScript (browser & Node.js)

// Encode
const encoded = btoa("Hello, World!");
// → "SGVsbG8sIFdvcmxkIQ=="

// Decode
const decoded = atob("SGVsbG8sIFdvcmxkIQ==");
// → "Hello, World!"

// Node.js Buffer (handles Unicode properly)
const enc = Buffer.from("Hello, 世界").toString("base64");
const dec = Buffer.from(enc, "base64").toString("utf8");

Python

import base64

encoded = base64.b64encode(b"Hello, World!").decode("utf-8")
# → "SGVsbG8sIFdvcmxkIQ=="

decoded = base64.b64decode("SGVsbG8sIFdvcmxkIQ==").decode("utf-8")
# → "Hello, World!"

Frequently Asked Questions