Base64 is everywhere in software, yet most developers use it without understanding what it does. It’s not encryption. It’s not compression. It’s a way to represent binary data using only text characters.

What Base64 Does

Base64 takes any data (text, images, files) and converts it into a string using only 64 characters: A-Z, a-z, 0-9, +, and /. Plus = for padding.

The input “Hello” becomes “SGVsbG8=”.

Every 3 bytes of input become 4 characters of output. This means Base64 encoded data is always about 33% larger than the original. It’s not compression. It’s the opposite.

Why It Exists

Many systems were designed to handle text only. Email (SMTP) was designed for ASCII text. HTTP headers are text. JSON is text. XML is text. URLs are text.

When you need to send binary data (an image, a PDF, raw bytes) through these text-only channels, you have a problem. Binary data contains bytes that can be misinterpreted as control characters, get corrupted by text processing, or simply aren’t valid in the format.

Base64 solves this by encoding binary data into safe text characters that survive any text-based transport.

Common Use Cases

1. Email attachments

When you attach a photo to an email, it’s Base64 encoded into the MIME message. Your email client decodes it back to the original image.

2. Data URLs in HTML/CSS

<img src="data:image/png;base64,iVBORw0KGgo..." />

Small images can be embedded directly in HTML without separate HTTP requests.

3. API authentication

HTTP Basic Auth sends credentials as username:password Base64 encoded in the Authorization header.

Important: Base64 is NOT encryption. Anyone can decode it. Basic Auth is only safe over HTTPS.

4. Storing binary in JSON

JSON has no binary type. If you need to include file data in a JSON payload, Base64 is the standard approach.

5. JWT tokens

JSON Web Tokens are three Base64-encoded segments separated by dots. The payload is readable by anyone who decodes it (again, it’s not encryption).

When NOT to Use Base64

  • For security: Base64 is encoding, not encryption. It provides zero security. Use AES, RSA, or similar for actual encryption.
  • For large files: The 33% size increase adds up. Sending a 10 MB file as Base64 means sending 13.3 MB. Use proper binary transfer (multipart form data) when possible.
  • When binary transport is available: If you can send raw bytes (WebSocket binary frames, gRPC, direct file upload), do that instead.

Variants You Might Encounter

  • Standard Base64: Uses + and /. Padding with =.
  • URL-safe Base64: Uses - and _ instead (because + and / have special meaning in URLs).
  • No-padding Base64: Omits the trailing = signs. Some systems don’t need them.

The Bottom Line

Base64 is a tool for making binary data survive text-based transport. It’s not security. It’s not compression. It makes things bigger but compatible. Use it when you must, avoid it when you can send binary directly.