What is Base64 encoding and when should you use it?

If you have worked with APIs, email attachments, or embedded images in CSS, you have probably run into Base64. It looks like garbled text — a long string of letters, numbers, plus signs and slashes. But it is not random. It is a precise, reversible way of turning binary data into plain text so it can travel safely through systems that were built to handle only text.

What Base64 actually is

Base64 is an encoding scheme — not encryption. It converts binary data (bytes) into a set of 64 printable ASCII characters: the 26 uppercase letters, 26 lowercase letters, the digits 0–9, plus + and /. The = character is used as padding at the end.

The name comes from the character set size: 64 possible characters, each representing 6 bits of data. Every 3 bytes of input (24 bits) becomes 4 Base64 characters (24 bits expressed as four 6-bit groups).

Why it exists

Many older protocols — email (SMTP), HTTP headers, XML, HTML — were designed to carry text only. When you need to send binary data (an image, a PDF, a compiled file) through one of these channels, raw bytes cause problems. Control characters get misinterpreted, null bytes terminate strings early, and line endings get converted differently on different systems.

Base64 sidesteps all of this by converting binary into a safe, printable text format that every system handles identically.

Common uses today

Base64 vs Base64url

Standard Base64 uses + and / as its 62nd and 63rd characters. These characters have special meaning in URLs — + becomes a space, and / separates path segments. This causes problems when Base64 strings appear in URLs.

The solution is Base64url, a variant that replaces + with - and / with _. It is used in JWTs, OAuth tokens and any context where Base64 data appears in a URL.

What Base64 is not

A common mistake is storing passwords or API keys in Base64 and considering them "protected." They are not. Base64 is completely reversible by design. For actual security, use proper encryption (AES) or hashing (bcrypt, SHA-256).

The size cost

Base64 encoding makes data larger — every 3 bytes of input becomes 4 characters of output. That is roughly a 33% size increase. For small strings this barely matters, but for large files it is worth considering. A 10 MB image becomes about 13.3 MB when Base64-encoded.

This is why Base64 data URIs are fine for small icons but a bad idea for large background images — you lose browser caching and inflate page weight significantly.

Decoding is just as simple

Because Base64 is fully reversible, decoding is just the process run in reverse. Given a valid Base64 string, any decoder will produce the exact original bytes — no information is lost. The only requirement is that the Base64 string is valid: correct characters, correct padding with = signs, and no extraneous whitespace that some encoders insert for readability.