Base64 Explained: What It Is and When You Actually Need It

Updated 2026-08-04 · 5 min read

Base64 is one of those things developers use constantly and explain badly. It is not encryption, not compression, and not a security measure. It solves a narrower and more practical problem.

The problem it solves

Many systems were designed to carry plain text and nothing else. Email is the classic case: the original protocols assumed 7-bit ASCII, so anything outside that range could be mangled or stripped in transit.

Binary data such as an image is not text. It contains byte values that mean nothing as characters, including control codes that older systems interpret as commands rather than content.

Base64 solves this by re-expressing arbitrary binary data using only 64 characters that travel safely everywhere: A–Z, a–z, 0–9, plus two symbols. The data is unchanged in meaning, just written in a safer alphabet.

How it works, briefly

The encoder takes three bytes at a time, which is 24 bits, and re-splits them into four groups of six bits. Each 6-bit group maps to one of the 64 characters.

That ratio explains the main cost: every three bytes become four characters, so Base64 data is roughly 33% larger than the original. When the input is not divisible by three, the output is padded with = characters, which is why so many Base64 strings end that way.

The misconception worth clearing up

Base64 is not security. It is not encryption, it is not obfuscation in any meaningful sense, and it protects nothing.

There is no key. Anyone can decode it instantly, and it is trivially recognisable by its character set and padding. Putting a password in Base64 is equivalent to writing it out plainly, with an extra step that fools nobody.

This matters because the mistake appears in real systems: credentials Base64-encoded in configuration files or request headers, treated as though they were protected. They are not.

Where it genuinely belongs

Email attachments. Still the original use, handled automatically by mail software.

Data URIs. A small image can be embedded directly in HTML or CSS as a Base64 string, avoiding a separate network request. Useful for tiny icons, wasteful for anything larger given the 33% overhead.

JSON payloads. JSON has no binary type, so binary data sent inside JSON is usually Base64 encoded.

Basic HTTP authentication. Credentials are Base64 encoded in the header — which is precisely why Basic auth must only ever be used over HTTPS. The encoding provides no protection; the transport layer does.

Cryptographic values. Keys, certificates and signatures are binary, and are commonly written in Base64 so they can be pasted into text files.

Variants that trip people up

Standard Base64 uses + and / as its final two characters. Both have special meaning in URLs, so a URL-safe variant substitutes - and _ instead.

If a Base64 string fails to decode, a mismatch between these variants is a common cause. Missing padding is another: some systems strip the trailing = characters, and stricter decoders then reject the input.

A note on text encoding

Base64 operates on bytes, not characters. To encode text you must first convert it to bytes using a character encoding, and UTF-8 is the sensible default.

Encoding with one scheme and decoding with another is how accented characters, Bangla, and emoji turn into garbage. If a decoded string looks corrupted while the ASCII parts are fine, a UTF-8 mismatch is almost always the reason.