Base64 Encoding Explained: What It Is and When to Use It

Base64 is an encoding scheme that converts binary data into a string of plain ASCII text. It was designed to allow binary content — like images, files, or arbitrary bytes — to travel safely through systems that were built to handle only text.

Why Base64 exists

Many protocols were designed decades ago when only text was transmitted — email (SMTP), HTTP headers, JSON fields, and XML documents are all text-based. If you try to embed raw binary data (like an image file) directly into a text field, the binary bytes will likely contain control characters that corrupt the transmission or break the parser.

Base64 solves this by converting every 3 bytes of binary data into 4 printable ASCII characters using a fixed alphabet of 64 characters (A–Z, a–z, 0–9, +, /). The encoded output is always valid text, safe to include in any text-based format.

Common uses of Base64

• Data URIs — embedding images directly into HTML or CSS as base64 strings to avoid separate HTTP requests
• JWTs (JSON Web Tokens) — the header and payload sections of a JWT are Base64-encoded JSON objects
• Email attachments — MIME encoding uses Base64 to attach binary files to email messages
• API authentication — Basic Auth credentials are sent as Base64-encoded username:password pairs
• Storing binary data in JSON — when an API needs to include binary content in a JSON response

Base64 is not encryption

This is the most important thing to understand about Base64: it is an encoding, not encryption. Anyone can decode a Base64 string instantly — no key, no password required. Do not use Base64 to hide sensitive data. Use it only to safely transport binary data through text-based channels.

How to recognise Base64

Base64-encoded strings only contain letters, numbers, +, /, and = characters. They often end with one or two = signs (padding). They are typically longer than the original data by about 33%. If you see a long string of alphanumeric characters ending in == inside a JWT, a data URI, or an API response, it is almost certainly Base64.

URL-safe Base64

Standard Base64 uses + and / which have special meaning in URLs. URL-safe Base64 replaces + with - and / with _ so the encoded string can be used directly in URLs and query parameters without percent-encoding. JWTs use URL-safe Base64 for this reason.