What Base64 actually is

Base64 is an encoding scheme that represents binary data using only 64 printable ASCII characters. Every 3 bytes of input becomes 4 characters of output, so the encoded form is always about one-third larger than the original. The name comes from the 64-character alphabet (A–Z, a–z, 0–9, plus and slash), with an equals sign used as padding.

Why anyone bothers

Many systems are designed to carry text, not raw bytes. Email has no reliable binary channel, JSON stores text, and URLs forbid many characters - but a Base64 string contains nothing but letters, digits, and two safe symbols. Encoding is the standard trick for moving binary safely through text-only transports.

Where you will actually see it

  • Data URLs: data:image/png;base64,... lets a small asset travel inside HTML or CSS without a separate request.
  • Authentication tokens: Basic Auth and JWT headers Base64-encode or part-encode their payloads (never rely on this for secrecy).
  • API attachments: when a JSON endpoint must carry a file, the file is Base64-encoded into a string field.
  • Email: MIME attachments are Base64-encoded so they survive mail servers.

The critical misunderstanding

Base64 is not encryption and provides no security. Anyone who sees the string can decode it instantly with any of a hundred free tools. If a value needs to be secret, encrypt it first - and never Base64 a password expecting to hide it.

When embedding pays off

Data URLs shine for tiny assets - a 200-byte logo or a handful of icons. At that size, saving a network request outweighs the 33% encoding overhead. The trade reverses quickly as files grow: embedding a 500KB image as Base64 inflates it to roughly 670KB and bloats your HTML. For real images, load them normally and let the browser cache them.

Hands-on check

Test any value: paste a short string, encode it, and note the output ends or evaluates with padding only when the input length is not a multiple of three. Decode it again and confirm you recover the exact original - a good way to verify your own API is encoding correctly.