Base64 Encoding Explained (It's Not Encryption)
Developer Tools - 3 min read - Published 2026-08-27 - Updated 2026-10-19
Base64 is a way of writing any data - an image, a PDF, binary bytes - using only 64 safe text characters. It exists because many systems were built to carry text and can corrupt raw binary data: email, URLs, JSON and HTML attributes all have characters they treat specially. Base64 sidesteps that by turning the data into plain letters and digits that pass through untouched.
The most important thing to know is what it isn't. Base64 is an encoding, not encryption. Anyone can decode it instantly, without a key.
How the encoding works
The alphabet is A-Z, a-z, 0-9, plus + and /, which makes 64 characters, so each one represents 6 bits. The encoder takes the input three bytes (24 bits) at a time and splits them into four 6-bit groups, each written as one character.
Worked example: the text Man is the bytes 77, 97 and 110. In binary that's 01001101 01100001 01101110. Regrouped into 6-bit pieces it becomes 010011 010110 000101 101110, which are 19, 22, 5 and 46 - the characters T, W, F and u. So Man encodes to TWFu.
Padding and the size cost
When the input isn't a multiple of three bytes, the output is padded with = signs to a multiple of four characters. Hi (two bytes) encodes to SGk=, with one = of padding; a single byte gets two.
Because every 3 bytes become 4 characters, Base64 makes data about 33% larger. A 300 KB image becomes about 400 KB of Base64 text. That's why embedding large images as Base64 in web pages usually slows them down: the image can't be cached separately and the page itself gets heavier.
Where you'll see it
Email attachments: email was designed for text, so attachments are Base64-encoded inside the message, traditionally broken into lines of 76 characters.
Data URLs: small images or fonts can be embedded directly in HTML or CSS as data:image/png;base64,... followed by the encoded file, saving a separate download for tiny icons.
JSON Web Tokens: the three parts of a JWT are Base64url-encoded, which is why you can paste a token into a decoder and read its contents. The signature proves it hasn't been changed, but the contents themselves aren't hidden.
HTTP Basic authentication: the header Authorization: Basic dXNlcjpwYXNz is simply user:pass in Base64. It's only safe over HTTPS, which encrypts the whole request.
The URL-safe variant
Standard Base64 uses + and /, which have special meanings in URLs and file names. Base64url, defined alongside standard Base64 in RFC 4648, replaces them with - and _ and often drops the = padding. JWTs and many APIs use it. If decoding fails with an "invalid character" error, check whether the text is the URL-safe variant.
Text and character sets
Base64 works on bytes, not characters. To encode text, it must first be turned into bytes, almost always as UTF-8. Mismatches cause garbled results: in JavaScript, the built-in btoa function only handles characters in the Latin-1 range and throws an error on emoji or most non-European text unless the text is converted to UTF-8 bytes first. When decoded text shows odd characters such as é, it was usually decoded with a different character set from the one used to encode it.
Why it gives no security
Base64 has no key and no secret: the algorithm is public and decoding takes milliseconds. Passwords, API keys or personal data stored in Base64 are effectively stored in plain text, just harder to read at a glance. If data needs protecting, encrypt it with a real algorithm such as AES-256 and keep the key separate; Base64 can then be used to carry the encrypted bytes as text.