What Is Base64 Encoding, and When Should You Use It?
Base64 is everywhere — in data URLs, JWTs, email attachments and API payloads. It is also widely misunderstood as a form of security.
Quick answer
Base64 converts binary data into a 64-character alphabet of letters, digits, plus and slash. Its purpose is to let arbitrary bytes travel safely through channels that only expect text, such as email headers, URLs, JSON strings and HTML attributes.
Base64 is transport, not security
Base64 converts binary data into a 64-character alphabet of letters, digits, plus and slash. Its purpose is to let arbitrary bytes travel safely through channels that only expect text, such as email headers, URLs, JSON strings and HTML attributes.
It is not encryption. Anyone can decode a Base64 string in one step, with no key. If you need confidentiality, encrypt the data first and then Base64-encode the ciphertext for transport.
Why the output is bigger
Base64 represents every 3 bytes of input as 4 characters of output, which makes encoded data roughly 33% larger than the original. That overhead is the price of text safety, and it is why large images inlined as data URLs can noticeably inflate an HTML page.
Where you will meet it
Base64 shows up in more places than most people expect.
- Data URLs — inline images and fonts embedded directly in CSS or HTML
- JWTs — the header and payload of a token are base64url-encoded JSON
- Basic authentication — the username and password pair in an HTTP header
- Email attachments — MIME encodes binary files as Base64
Base64 vs base64url
The standard alphabet includes + and /, which have special meanings in URLs. The base64url variant swaps them for - and _ and usually drops the = padding. JWTs use base64url, which is why pasting a raw JWT segment into a strict Base64 decoder sometimes fails.
Unicode and UTF-8
Base64 operates on bytes, not characters. Text has to be converted to UTF-8 bytes first, otherwise emoji and accented characters break. A well-built browser encoder handles this conversion for you, so 🎉 round-trips correctly.
Tools mentioned in this guide
FAQ
Is Base64 encryption?
No. It is a reversible encoding with no key. Anyone can decode it instantly, so never use it to protect passwords or secrets.
Why does my decoded JWT payload look garbled?
JWTs use base64url, not standard Base64. Replace - with + and _ with / and add padding, or use a decoder that supports base64url directly.