Base64 Encoding Explained: Why and How Developers Use It

Base64 is one of those concepts every developer encounters but few fully understand. Let's demystify it.

What Is Base64?

Base64 is an encoding scheme that converts binary data into ASCII text using a set of 64 characters (A-Z, a-z, 0-9, +, /). It's designed to safely transmit binary data through text-based systems like email, URLs, and JSON.

Important: Base64 is encoding, NOT encryption. It provides zero security — anyone can decode it instantly.

Why Do We Need Base64?

Many systems can only handle text safely. When you need to include binary data (images, files, certificates) in text-only contexts, Base64 bridges the gap:

1. Embedding images in HTML/CSS — Data URIs use Base64 to inline small images

2. Email attachments — MIME encoding uses Base64 to send files via email

3. API payloads — Binary data in JSON responses must be Base64-encoded

4. Authentication headers — HTTP Basic Auth encodes credentials in Base64

5. JWT tokens — The header and payload are Base64URL-encoded

How Base64 Works

1. Take 3 bytes (24 bits) of binary data

2. Split into 4 groups of 6 bits each

3. Map each 6-bit group to one of 64 characters

4. If the input isn't divisible by 3, pad with = characters

Example

The string "Hi" in ASCII is: 72 105 (two bytes)

In binary: 01001000 01101001

Split into 6-bit groups: 010010 000110 1001xx

Mapped to Base64: S G k =

Result: SGk=

Base64 Increases Size

A critical detail: Base64 encoding increases data size by approximately 33%. Three bytes of input produce four bytes of output. This is why you should NOT Base64-encode large files for API transmission — use proper binary transfer instead.

Base64 vs Base64URL

Standard Base64 uses + and / characters, which are problematic in URLs. Base64URL replaces them:

• + → - (minus)

• / → _ (underscore)

• = padding is often omitted

JWT tokens use Base64URL encoding for this reason.

When NOT to Use Base64

• "Encrypting" data — Base64 provides zero security

• Large file transfers — Use multipart/form-data or binary streams

• Storing images in databases — Use file storage and reference by URL

• "Hiding" API keys — They can be instantly decoded