Base64 Encoding: What It Is, How It Works, and When You Actually Need It

Base64 shows up constantly in development: JWT tokens, email attachments, image data URIs, API credentials, binary data in JSON. Understanding what it does (and what it doesn't do) takes about five minutes and saves a lot of confusion.

What Base64 actually does

Base64 converts binary data into a text representation using 64 characters: A-Z, a-z, 0-9, +, and /. Binary data can contain any byte value — including characters that break text-based systems. Base64 maps binary to a safe, printable subset of ASCII that survives text transmission without corruption.

The size tradeoff

Base64 encoding increases file size by approximately 33%. Every 3 bytes of binary becomes 4 characters of Base64. A 1MB image becomes roughly 1.33MB encoded. This is the price of text-safe representation.

Common places you encounter Base64

• JWT tokens — the header and payload sections are Base64url-encoded JSON
• Data URIs — `data:image/png;base64,...` embeds images directly in HTML/CSS
• HTTP Basic Auth — credentials are Base64-encoded (not encrypted — this is often misunderstood)
• Email attachments — MIME encoding uses Base64 for binary attachments
• API credentials — some APIs send API keys or webhook secrets as Base64-encoded bytes

Base64 is NOT encryption

This is the most important thing to understand. Base64 is encoding, not encryption. Anyone can decode it instantly. HTTP Basic Auth credentials encoded in Base64 are not secret — they're just reformatted. Always use HTTPS when transmitting sensitive data, regardless of whether it's Base64-encoded.

Base64 vs Base64url

Standard Base64 uses + and / as special characters. These are problematic in URLs (they'd need percent-encoding). Base64url replaces + with - and / with _, making it URL-safe without extra encoding. JWTs use Base64url. When you're sending Base64 in a URL parameter, use the url-safe variant.