Base64 Explained: What It Is, How It Works and When to Use It

Video: What is Base64?. Embedded from YouTube in privacy-enhanced mode; all rights belong to the creator.

Base64 is everywhere once you start looking: email attachments, JSON Web Tokens, data URIs in CSS, basic-auth headers and API payloads carrying files. It solves one problem — moving binary data through channels designed for text — and it's worth understanding precisely so you use it correctly.

How it works

Base64 reads input in groups of 3 bytes (24 bits) and splits them into four 6-bit chunks. Each 6-bit value (0–63) maps to one character from a 64-character alphabet: A–Z, a–z, 0–9, + and /. When the input length isn't a multiple of three, the output is padded with =.

Text:      M        a        n
ASCII:     77       97       110
Bits:      01001101 01100001 01101110
6-bit:     010011 010110 000101 101110
Index:     19     22     5      46
Base64:    T      W      F      u        → "TWFu"

Because 3 bytes become 4 characters, encoded data is about 33% larger than the original — the price of text-safety.

Variants

• Standard (RFC 4648 §4) — uses + and /, padded with =.
• URL-safe (RFC 4648 §5) — swaps in - and _ so the result survives URLs and filenames; padding is often omitted. JWTs use this.
• MIME — standard alphabet, wrapped at 76 characters per line for email.

Good uses

• Embedding small images or fonts directly in CSS/HTML as data URIs.
• Sending binary files inside JSON APIs.
• Encoding binary keys or certificates (PEM files are Base64 between header lines).

Bad uses and myths

• “It's encrypted.” No — Base64 is reversible by anyone. Basic-auth credentials in Base64 are effectively plain text, which is why they must only travel over HTTPS.
• Large files in JSON. The 33% overhead plus parsing cost adds up; use multipart uploads or pre-signed URLs for anything big.
• Big data URIs. They can't be cached separately and bloat HTML; keep them to tiny assets.

Unicode gotcha

JavaScript's btoa() only accepts Latin-1 characters and throws on emoji or most non-European text. Encode to UTF-8 bytes first — our Base64 tool does this automatically.

Try the tools