What is Base64 Encoding and When Should You Use It?

If you've worked with APIs, emails, or embedded images, you've likely encountered Base64. But what exactly is it, and why do we need it?

The Problem Base64 Solves

Many systems — email protocols, URLs, JSON — are designed to handle text, not binary data. When you need to transmit binary data (like an image, a file, or encrypted bytes) through these text-based channels, things break.

Base64 solves this by converting binary data into a safe set of 64 ASCII characters:

A-Z, a-z, 0-9, +, /

Plus = for padding.

How It Works

Base64 takes every 3 bytes (24 bits) of input and splits them into 4 groups of 6 bits. Each 6-bit group maps to one of the 64 characters.

Input:   "Hi"
Binary:  01001000 01101001
Base64:  SGk=

Since "Hi" is only 2 bytes (not divisible by 3), padding (=) is added.

Common Use Cases

1. Data URIs in HTML/CSS

Embed small images directly in your HTML without extra HTTP requests:

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUg..." />

2. API Authentication

HTTP Basic Auth sends credentials as Base64:

Authorization: Basic dXNlcjpwYXNzd29yZA==

(This is user:password encoded — not encrypted!)

3. JWT Tokens

JSON Web Tokens use Base64URL encoding for the header and payload sections.

4. Email Attachments

MIME encoding uses Base64 to attach binary files to emails.

Important: Base64 is NOT Encryption

A common misconception — Base64 is encoding, not encryption. Anyone can decode it. Never use it to "hide" sensitive data.

// Anyone can decode this
atob('cGFzc3dvcmQxMjM=') // "password123"

The Size Overhead

Base64 increases data size by approximately 33%. Every 3 bytes become 4 characters. Keep this in mind when embedding large files.

URL-Safe Base64

Standard Base64 uses + and /, which have special meaning in URLs. URL-safe Base64 replaces them:

• + → -
• / → _
• Padding = is removed

This variant is used in JWTs and URL parameters.

Try It Yourself

Use our Base64 Encode/Decode tool to experiment with encoding and decoding text. It supports both standard and URL-safe modes, all running in your browser.