What Is Base64 Encoding? A Plain-English Guide

Base64 turns binary data into plain text. It's how images get embedded in HTML, how files ride along in email, and how JSON APIs transport binary payloads. It is not encryption — anyone can reverse it in an instant — but it solves a real problem that comes up constantly in computing.

The problem Base64 solves

Imagine you want to send an image through email. Email was designed in the early 1970s, when messages were plain ASCII text — only letters, numbers, punctuation, and line breaks. Images are bytes, and many of those bytes aren't valid ASCII characters. Sending raw image bytes through a text-only system would corrupt the data.

The same problem shows up everywhere:

• Embedding an icon in a CSS file (which is text-only)
• Storing an image in a JSON API response (JSON is text)
• Sending a public key in an HTTP header (headers are text)
• Including a file in a URL query string (URLs are text)

All these systems expect text. Base64 is a way to represent arbitrary binary data as characters those systems can safely carry.

How Base64 works

Base64 takes groups of 3 bytes (24 bits) and splits them into 4 groups of 6 bits. Each 6-bit value maps to one of 64 possible characters. Since every value is 0–63, exactly 64 characters are needed to represent them all.

The 64 characters used are:

• A–Z (26 characters)
• a–z (26 characters)
• 0–9 (10 characters)
• + and / (2 characters)

That's 26 + 26 + 10 + 2 = 64. Every one of these characters is guaranteed to survive transport through text-only systems without modification.

Here's a concrete example. The text Man is 3 bytes: 77, 97, 110 in decimal. Split into 6-bit groups: 010011 010110 000101 101110. Those map to 19, 22, 5, 46. In Base64, that's TWFu. So Man encodes to TWFu.

Because 3 bytes become 4 characters, Base64 output is always larger than the input — 4/3 the size, or about 33% larger.

What Base64 is not

This is the single most important thing to understand about Base64: it is not encryption.

Encryption scrambles data so that only someone with a key can reverse it. Encoding is a reversible transformation that anyone can undo. Base64 is an encoding. Given a Base64 string, anyone — you, me, a script, an automated scanner — can decode it back to the original data in microseconds.

The characters S3VraWUgY29va2ll might look scrambled, but they decode to Kukie cookie. Not secret at all.

If you see Base64 in a URL or config file and assume it's protecting something, you're wrong. It's just a text-safe wrapper. Never use Base64 to hide a password, an API key, or anything sensitive.

Where you'll see Base64

Base64 shows up in more places than most people realize. Once you know the pattern, you'll start noticing it:

Data URLs in HTML and CSS

An image can be embedded directly in HTML or CSS as a "data URL" — a Base64-encoded version of the image file. This avoids a separate HTTP request:

background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUg...");

Great for small icons and logos. Less great for large photos, because of the 33% size increase.

Email attachments (MIME)

When you attach a photo to an email, the mail client encodes the file as Base64 and embeds it in the message body. Email servers only understand text, so Base64 is what allows binary files to be attached.

JSON Web Tokens (JWTs)

JWTs — the token format used by most modern web APIs for authentication — are three Base64-encoded segments separated by dots. The header and payload are both Base64. This isn't security; it's transport. The signature on the end is what provides the security.

HTTP Basic Authentication

The old "Basic Auth" header sends username:password as Base64. Again: encoding, not encryption. Basic Auth is only safe over HTTPS, because otherwise the credentials are trivially decoded by anyone watching the wire.

APIs that transport binary data

Many REST APIs accept or return files (PDFs, images, audio) as Base64-encoded strings inside JSON. It's simpler than multipart form uploads, at the cost of larger payloads.

How to encode or decode Base64

On the command line, most Unix-like systems have the base64 utility built in:

# Encode a string
echo -n "Hello, world" | base64
# Output: SGVsbG8sIHdvcmxk

# Decode
echo "SGVsbG8sIHdvcmxk" | base64 -d
# Output: Hello, world

In JavaScript, the browser provides btoa() and atob() for simple ASCII strings — but they don't handle Unicode correctly on their own. For real-world use, you need to UTF-8-encode first.

The easiest option is a browser tool. Your Online Helper's Encoder handles Base64 correctly for Unicode text (accented characters, emoji, non-Latin scripts) and runs entirely in your browser. No data is sent to a server, and it works offline after the first visit.

Base64 vs. Base64URL

The standard Base64 alphabet uses + and /. But those two characters have special meanings in URLs — + means space, / means path separator. So a variant called Base64URL substitutes - for + and _ for /. JWTs, for example, use Base64URL.

The underlying algorithm is identical; only the last two characters differ. If you decode a JWT with a standard Base64 decoder, replace - with + and _ with / first.