Base64 Encoding Explained: What It Is and When to Use It

Published 2026-02-04 • Updated 2026-02-04

Published February 4, 2026 • 8 min read

Base64 is everywhere — in emails, data URLs, API auth headers, and more. But what exactly is it? This guide explains Base64 encoding in plain English.

What is Base64?

Base64 is a way to convert binary data (bytes) into text using only 64 characters: A-Z, a-z, 0-9, +, and /. Think of it as a translation layer that makes binary data safe for text-only systems.

Example:

Text:    "Hello"
Base64:  "SGVsbG8="

Why Base64 Exists

Some systems only handle text, not binary:

• Email: SMTP was designed for text
• JSON/XML: These formats don't support binary
• URLs: Some characters break URLs
• HTML/CSS: Embedding binary images

How Base64 Works

1. Take 3 bytes (24 bits) of input
2. Split into 4 groups of 6 bits
3. Convert each 6-bit group to a Base64 character
4. Repeat for all data

Character Set:

Value   Char  |  Value   Char  |  Value   Char
0-25    A-Z   |  26-51   a-z   |  52-61   0-9
62      +     |  63      /     |  Padding =

The Padding Problem

If input isn't a multiple of 3 bytes, Base64 adds = for padding:

"A"    → "QQ=="  (1 byte → 2 padding chars)
"AB"   → "QUI="  (2 bytes → 1 padding char)
"ABC"  → "QUJD"  (3 bytes → no padding)

Common Use Cases

1. Email Attachments

MIME uses Base64 to send binary files via email:

Content-Transfer-Encoding: base64
SGVsbG8gd29ybGQh...

2. Data URLs

Embed images directly in HTML/CSS:

<img src="data:image/png;base64,iVBORw0KG..." />

3. HTTP Basic Authentication

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

(That's username:password encoded)

4. JWT Tokens

JSON Web Tokens use Base64URL (a variant) for encoding:

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.signature

5. Storing Binary in JSON

JSON doesn't support binary, so encode it:

{
  "image": "iVBORw0KGgoAAAANSUhEUgAA..."
}

How to Encode/Decode

JavaScript/Node.js

// Encode
const encoded = btoa("Hello");
console.log(encoded); // "SGVsbG8="

// Decode
const decoded = atob("SGVsbG8=");
console.log(decoded); // "Hello"

// For Unicode (use this):
const encoded = btoa(unescape(encodeURIComponent("Hello 世界")));
const decoded = decodeURIComponent(escape(atob(encoded)));

Python

import base64

# Encode
encoded = base64.b64encode(b"Hello")
print(encoded)  # b'SGVsbG8='

# Decode
decoded = base64.b64decode(b"SGVsbG8=")
print(decoded)  # b'Hello'

Command Line

# Encode
echo -n "Hello" | base64

# Decode
echo "SGVsbG8=" | base64 -d

Base64 vs Base64URL

Standard Base64 uses + and /, which break URLs. Base64URL replaces them:

Standard: + / =
URL-safe: - _ (no padding)

Used in: JWT, URL parameters, filenames

Size Increase

Base64 increases size by ~33%:

1 KB binary  → 1.33 KB Base64
1 MB binary  → 1.33 MB Base64

This is why you shouldn't Base64-encode large files unless necessary.

Security Misconception

⚠️ Base64 is NOT encryption!

It's encoding, not security. Anyone can decode Base64:

echo "U2VjcmV0UGFzc3dvcmQ=" | base64 -d
# Outputs: SecretPassword

Never use Base64 to "hide" passwords or sensitive data.

When NOT to Use Base64

• Large files: 33% size increase for no benefit
• Binary APIs: Send binary directly (multipart/form-data)
• Security: Use actual encryption (AES, RSA)
• Compression: Base64 makes data incompressible

Base64 Variants

• Standard: A-Za-z0-9+/=
• URL-safe: A-Za-z0-9-_ (no padding)
• MIME: Line breaks every 76 characters
• UTF-7: Modified Base64 for email

Performance Tips

• Decode Base64 data once, not repeatedly
• Stream large Base64 data instead of loading all at once
• Consider binary formats (protobuf, MessagePack) instead
• Cache decoded results

Quick Reference

✓ Use Base64 for:
  - Email attachments
  - Data URLs
  - JSON with binary data
  - HTTP Basic Auth

✗ Don't use Base64 for:
  - Encryption/security
  - Large file transfers
  - When binary is supported
  - Obfuscation

Try It Yourself

Use our free Base64 encoder/decoder to encode or decode strings instantly. No installation, runs in your browser.