Base64 encoding, explained: what it is, what it isn't, and when to use it

Base64 is one of those things every developer copy-pastes for years before anyone explains what it actually does. The one-sentence version: Base64 is a way to represent binary data using only 64 plain-text characters, so that data can pass through channels that were built for text.

It is not encryption. It is not compression. Anyone can decode it in one step. If you remember nothing else, remember that.

The problem it solves

Plenty of systems were designed to carry text and only text — email bodies, URLs, JSON string fields, HTTP headers, XML documents. Hand them raw binary (an image, a .zip, an encryption key) and bytes get mangled: a stray 0x00 terminates a string, a high-bit byte gets re-encoded, a newline sneaks in.

Base64 sidesteps all of that by re-expressing binary using a safe alphabet: A–Z, a–z, 0–9, and two extras (+ and /), with = as padding.

How it works, briefly

The name is the recipe. Base64 takes your data three bytes at a time — that's 24 bits — and re-slices those 24 bits into four groups of six. Six bits can express 64 values, and each value maps to one character in the alphabet.

Input:   M       a       n
ASCII:   77      97      110
Bits:    01001101 01100001 01101110
Regroup: 010011 010110 000101 101110
Base64:  T      W      F      u

So Man becomes TWFu. When the input isn't a clean multiple of three bytes, the = padding characters fill the gap — which is why Base64 strings so often end in one or two equals signs.

The trade-off: the output is always about 33% larger than the input, since you're spending 4 characters for every 3 bytes.

What Base64 is not

This is where people get burned:

It is not encryption. There's no key. decode(encode(x)) == x for everyone. Base64-ing a password protects nothing.
It is not compression. It makes data bigger, not smaller.
It is not a checksum. It doesn't detect corruption.

If you see a Base64 blob storing something sensitive with no other protection, that's a bug, not a feature.

Where you'll actually meet it

Data URIs — data:image/png;base64,iVBORw0KGgo… embeds an image directly in HTML or CSS.
JWTs — the header and payload of a JSON Web Token are Base64url-encoded (a URL-safe variant that swaps +/ for -_).
Basic Auth headers — Authorization: Basic <base64 of user:pass> (again: encoded, not encrypted — always send it over HTTPS).
Email attachments — MIME has used Base64 to shovel binary through text-only mail transport for decades.

Decode one right now

Got a mystery blob ending in ==? Paste it into our Base64 decoder and read it instantly — it runs entirely in your browser, so whatever you decode never leaves your machine. It's the quickest way to prove to yourself that Base64 is a costume, not a vault.