Base64 Encoding Explained: What It Is, How It Works, and When to Use It

If you've spent any time looking at code or API responses, you've probably run into Base64 strings before. They look like gibberish, something like SGVsbG8gV29ybGQh. You'll find them in data URIs, email headers, API payloads, and auth tokens. But what is Base64 actually doing, and why does it keep showing up?

This guide covers what Base64 encoding is, how the conversion actually works at the bit level, where it makes sense to use it, and how to encode and decode data in several popular languages.

What is Base64 encoding?

Base64 is a way to turn binary data into plain ASCII text. It uses a set of 64 characters that are safe to pass through almost any system:

• A-Z (26 uppercase letters)
• a-z (26 lowercase letters)
• 0-9 (10 digits)
• + and / (2 special characters)
• = (padding character, used to round output length to a multiple of 4)

Because the output is plain text, Base64 data can travel safely through systems that only handle ASCII, like email protocols, JSON APIs, and XML documents.

How Base64 encoding works

Here's what happens when you encode the string "Hi!":

Step 1: Convert to binary

H  = 72  = 01001000
i  = 105 = 01101001
!  = 33  = 00100001

That gives us: 010010000110100100100001 (24 bits total)

Step 2: Split into 6-bit chunks

010010 = 18
000110 = 6
100100 = 36
100001 = 33

Step 3: Look up each value in the Base64 table

18 → S
6  → G
36 → k
33 → h

So "Hi!" encodes to "SGkh".

Padding with =

When the input length isn't divisible by 3, Base64 pads the output with = characters so the result is always a multiple of 4 characters long:

"H"   → "SA=="   (1 byte → 4 chars with 2 padding)
"Hi"  → "SGk="   (2 bytes → 4 chars with 1 padding)
"Hi!" → "SGkh"   (3 bytes → 4 chars, no padding)

Why Base64 encoding exists

The problem: binary data in text-only protocols

A lot of widely used systems were built to handle text only:

• Email (SMTP) was originally text-only and can't carry raw binary attachments
• JSON is a text format, and binary data would break the parser
• XML is text-based and needs encoding for any embedded binary content
• URLs reserve many characters, and raw binary would break links

The fix: turn binary into text

Base64 lets you represent any binary data using only safe ASCII characters. The tradeoff is a 33% increase in size.

Common use cases for Base64

1. Data URIs (embedding images in HTML/CSS)

<!-- Instead of external file -->
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUA..." />

/* CSS background image */
.logo {
  background: url('data:image/svg+xml;base64,PHN2ZyB4bWxucz0i...');
}

This saves you an HTTP request, which can speed up page loads for small images. On the other hand, it makes your HTML/CSS files bigger, and the browser can't cache the image separately.

2. API responses (sending files as JSON)

{
  "filename": "report.pdf",
  "content": "JVBERi0xLjQKJeLjz9MKNCAwIG9iago8PC9M...",
  "encoding": "base64"
}

Since JSON has no way to represent binary data natively, REST APIs will often Base64-encode file contents and send them as strings.

3. Email attachments (MIME encoding)

Content-Type: image/jpeg; name="photo.jpg"
Content-Transfer-Encoding: base64

/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDA...

SMTP was built for 7-bit ASCII text, so any file you attach to an email gets Base64-encoded behind the scenes.

4. Authentication tokens

// HTTP Basic Authentication header
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

// Decoded value: "username:password"

JWT tokens, API keys, and OAuth tokens all commonly use Base64 or Base64URL encoding.

How to encode and decode Base64

JavaScript (Browser/Node.js)

// Encode
const encoded = btoa("Hello World!");  // "SGVsbG8gV29ybGQh"

// Decode
const decoded = atob("SGVsbG8gV29ybGQh");  // "Hello World!"

// For Unicode strings (use TextEncoder)
const utf8Encoded = btoa(new TextEncoder().encode("こんにちは"));

Python

import base64

# Encode
encoded = base64.b64encode(b"Hello World!")  # b'SGVsbG8gV29ybGQh'

# Decode
decoded = base64.b64decode(b"SGVsbG8gV29ybGQh")  # b'Hello World!'

# For strings (not bytes)
encoded_str = base64.b64encode("Hello".encode()).decode()  # "SGVsbG8="

PHP

<?php
// Encode
$encoded = base64_encode("Hello World!");  // "SGVsbG8gV29ybGQh"

// Decode
$decoded = base64_decode("SGVsbG8gV29ybGQh");  // "Hello World!"
?>

Command line

# Linux/Mac: Encode
echo -n "Hello World!" | base64  # SGVsbG8gV29ybGQh

# Linux/Mac: Decode
echo "SGVsbG8gV29ybGQh" | base64 --decode

# Windows PowerShell: Encode
[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("Hello World!"))

# Windows PowerShell: Decode
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("SGVsbG8gV29ybGQh"))

Online tools (no code needed)

If you just need a quick encode or decode without writing any code, you can use our Base64 Encoder and Base64 Decoder. Paste your text, click the button, done.

Base64 vs. Base64URL: what's the difference?

Standard Base64 uses + and /, both of which cause problems in URLs and filenames. Base64URL swaps them out:

Use Base64URL when your encoded data will end up in JWT tokens, URL parameters, or filenames.

Common mistakes and gotchas

1. Base64 is NOT encryption

Don't use Base64 to "hide" passwords or sensitive data. Anyone can decode it instantly. If you need actual security, use proper encryption like AES or RSA.

2. Unicode strings need UTF-8 encoding first

JavaScript's btoa() only works with ASCII characters. If you pass it Unicode, it'll throw an error:

// Wrong (throws error)
btoa("こんにちは");  // ❌ DOMException

// Correct
const utf8Bytes = new TextEncoder().encode("こんにちは");
const base64 = btoa(String.fromCharCode(...utf8Bytes));  // ✅

3. Base64 increases size by ~33%

Embedding a large image as a Base64 string in your HTML will bloat the page and slow things down. Stick with external files for anything bigger than a few KB.

When NOT to use Base64

• Large files in web pages. Use a CDN or regular URLs instead.
• Database storage. Store files as BLOBs or keep file paths, not Base64 text.
• Security. Encoding is not encryption. Use real crypto.
• Performance sensitive apps. Binary formats are smaller and faster to process.

Wrapping up

Base64 is a straightforward way to squeeze binary data through text-only channels. It works well for embedding small files, sending data over JSON APIs, and handling email attachments. It does not work well as a security measure, and the 33% size overhead means you should think twice before Base64-encoding anything large.

Want to encode or decode something right now? Try our free Base64 Encoder and Base64 Decoder tools. No signup, no code needed.