What is Base64 Encoding?

Base64 in a Nutshell

Base64 is an encoding scheme that converts binary data into ASCII text using 64 printable characters. It transforms any data — images, PDFs, executables, Unicode text — into a safe string of letters, numbers, and two symbols (+ and /).

Base64 is not encryption. It provides no security — anyone can decode it instantly. It's a transport encoding: it makes binary data safe to transmit through text-only channels like email (SMTP), URLs, JSON, XML, and HTTP headers.

How Base64 Works

1. Take 3 bytes (24 bits) of input data.
2. Split into 4 groups of 6 bits each.
3. Map each 6-bit value (0-63) to a character from the Base64 alphabet: A-Z (0-25), a-z (26-51), 0-9 (52-61), + (62), / (63).
4. Pad with = if the input isn't a multiple of 3 bytes.

"Hi" → bytes: 72, 105 → binary: 01001000 01101001
Split into 6-bit groups: 010010 000110 1001(00) ← padded
Map to Base64: S G k =
Result: "SGk="

3 bytes become 4 characters. This means Base64-encoded data is always ~33% larger than the original.

The Padding Character (=)

The = padding ensures the output length is always a multiple of 4. If the input has 1 leftover byte, the output ends with ==. If 2 leftover bytes, it ends with =. If the input is exactly divisible by 3, there's no padding.

"A"     → "QQ=="     (1 byte → 2 padding)
"AB"    → "QUI="     (2 bytes → 1 padding)
"ABC"   → "QUJD"     (3 bytes → no padding)
"ABCD"  → "QUJDRA==" (4 bytes → 2 padding)

Common Use Cases

• Email attachments (MIME) — SMTP only supports 7-bit ASCII. Base64 encodes binary attachments (images, PDFs) for safe email transport.
• Data URIs — Embed images directly in HTML/CSS: src="data:image/png;base64,iVBOR...". Eliminates an HTTP request.
• HTTP Basic Auth — Credentials are Base64-encoded: Authorization: Basic dXNlcjpwYXNz (user:pass).
• JWT tokens — JWT header and payload are Base64url-encoded JSON objects.
• API payloads — Binary data (files, images) in JSON APIs, since JSON doesn't support binary.
• Cryptographic keys — PEM certificates and SSH keys use Base64 encoding.

Base64 vs Base64url

Standard Base64 uses + and / which are special characters in URLs. Base64url (RFC 4648) replaces them with - and _, making the output URL-safe without percent-encoding. Base64url is used in JWTs, OAuth tokens, and anywhere Base64 data appears in URLs.

Base64 is NOT Encryption

Important: Base64 provides zero security. It's a reversible encoding, not encryption. Anyone can decode Base64 data instantly. Never use Base64 to "hide" passwords, API keys, or sensitive data. For actual encryption, use AES. For password hashing, use bcrypt.

Base64 in Code

btoa("Hello")    // "SGVsbG8="
atob("SGVsbG8=") // "Hello"

import base64
base64.b64encode(b"Hello")
base64.b64decode("SGVsbG8=")

echo -n "Hello" | base64
echo "SGVsbG8=" | base64 -d

base64.StdEncoding
  .EncodeToString(data)
base64.StdEncoding
  .DecodeString(encoded)