DeveloperEncodingAPIs

What Is Base64 Encoding?

Base64 explained for developers: how bytes become text, why 3 bytes become 4 characters, what padding means, when to use Base64URL, and why encoding is not encryption.

7 min read

TL;DR - Key Points

Base64 definitionBase64 is a binary-to-text encoding that represents bytes using a 64-character alphabet.

Why it existsIt lets binary data travel through text-oriented systems such as JSON, HTML, CSS, email, headers, and URLs.

How it worksBase64 takes 3 input bytes, or 24 bits, splits them into four 6-bit groups, and maps each group to one printable character.

Size overheadBase64 output is roughly 33% larger than the original binary data because 3 bytes become 4 characters.

PaddingThe = character pads output when input length is not a multiple of 3, keeping the encoded length a multiple of 4.

Not encryptionBase64 is reversible encoding, not secrecy. Anyone can decode it, so never use it to hide passwords or secrets.

What Is Base64?

Base64 is a way to represent binary data as plain text. Computers store files, images, PDFs, cryptographic keys, and many API payloads as bytes. But many systems are designed around text: JSON strings, HTML, CSS, email messages, HTTP headers, logs, and configuration files. Base64 bridges that gap by converting arbitrary bytes into a predictable set of printable characters.

The name Base64 comes from the alphabet size. Each encoded character represents one of 64 possible values. Because 64 is 2 to the power of 6, each Base64 character carries 6 bits of information. The encoder groups binary data into 24-bit blocks, splits each block into four 6-bit chunks, and maps those chunks to characters.

Base64 is common in developer work because it makes data easier to embed and transport. You will see it in data URLs, email attachments, Basic Auth, JWTs, OAuth PKCE, certificates, file uploads, and API debugging.

The tradeoff is size and secrecy. Base64 output is larger than the original data, and it does not hide anything. It is a packaging format, not a security boundary.

How Base64 Encoding Works

Base64 Formula

3 bytes (24 bits) -> 4 Base64 characters (6 bits each)

InputRaw bytes from text, image, PDF, or binary data - Man = 77 97 110 in ASCII bytes

BitsEach byte is 8 bits; 3 bytes are 24 bits - 01001101 01100001 01101110

Groups24 bits split into four 6-bit groups - 010011 010110 000101 101110

OutputEach 6-bit value maps to Base64 alphabet - Man -> TWFu

The easiest way to remember Base64 is 3 bytes become 4 characters. Three bytes are 24 bits. Four Base64 characters each carry 6 bits. Four times six is 24, so the mapping fits cleanly.

When the input is not a multiple of 3 bytes, the encoder adds padding so the output still lines up in 4-character blocks.

The Base64 Alphabet

Value Range	Characters	Notes
0-25	A-Z	Uppercase letters
26-51	a-z	Lowercase letters
52-61	0-9	Digits
62	+	Standard Base64 character; replaced by - in Base64URL
63	/	Standard Base64 character; replaced by _ in Base64URL
Padding	=	Not part of the 64 data values; used to pad final output

Worked Examples

Example 1 - Text to Base64

textHello

bytes5 bytes

base64SGVsbG8=

Hello is encoded as bytes, grouped into 6-bit chunks, then padded because 5 bytes is not divisible by 3.

Hello -> SGVsbG8=

The final = tells the decoder that padding was added.

Example 2 - No padding needed

textMan

bytes3 bytes

base64TWFu

3 bytes become exactly 4 Base64 characters, so no = padding is needed.

Man -> TWFu

This is a classic Base64 example because it fits one full 24-bit block.

Example 3 - Basic Auth header

valueusername:password

base64dXNlcm5hbWU6cGFzc3dvcmQ=

headerAuthorization: Basic ...

The username and password pair is encoded to a text-safe Base64 string.

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

This is not encryption. Basic Auth must be sent only over HTTPS.

Padding Rules

Input Bytes	Remainder	Output	Padding	Example
3 bytes	0	4 chars	None	Man -> TWFu
2 bytes	2	4 chars	One =	Ma -> TWE=
1 byte	1	4 chars	Two ==	M -> TQ==
4 bytes	1 after first block	8 chars	Two == at end	Many -> TWFueQ==

Some formats omit padding for compactness. A decoder can usually restore missing padding based on string length, unless the length is invalid.

Base64 Variants

Variant	Alphabet	Common Use	Gotcha
Standard Base64	A-Z a-z 0-9 + / with = padding	Email, binary-to-text conversion, data URIs	+ and / can be awkward in URLs or filenames.
Base64URL	A-Z a-z 0-9 - _ with optional padding	JWT, URL tokens, OAuth PKCE, filenames	Do not decode as standard Base64 until you replace - and _ or use a Base64URL decoder.
MIME Base64	Standard alphabet with line wrapping	Email attachments	Line breaks may need to be ignored by decoders.
Unpadded Base64	Padding omitted	Compact tokens and URLs	Decoder may need to restore padding before decoding.

Common Base64 Use Cases

Use Case	Example	Why Base64 Helps
Data URIs	data:image/png;base64,iVBOR...	Embed small images or fonts directly in CSS or HTML.
JSON APIs	{ "file": "JVBERi0x..." }	Send binary files through text-only JSON payloads.
Email attachments	MIME encoded file bodies	Transmit binary attachments through email systems built around text.
JWTs	header.payload.signature	JWT header and payload use Base64URL-encoded JSON.
Basic Auth	Authorization: Basic dXNlcjpwYXNz	Represent username:password as a header-safe string.
Certificates and keys	PEM armor	Represent binary cryptographic material in text files.

Base64 vs Hex vs URL Encoding

Format	Expansion	Alphabet	Best For
Base64	About 33%	64 symbols plus padding	Compact binary-to-text transfer
Hex	100%	0-9 and a-f	Debugging bytes, hashes, colors, binary inspection
URL encoding	Variable	%XX escapes	Making URL components safe, not binary compression
Plain UTF-8 text	None for ASCII	Unicode bytes	Normal text, not arbitrary binary

Common Base64 Mistakes

Mistake	Better Approach
Treating Base64 as encryption	Use encryption first, then Base64-encode the ciphertext only if you need text transport.
Putting secrets in Base64	Assume every Base64 value is public once someone has the string.
Using standard Base64 in URLs	Use Base64URL or URL-encode +, /, and = characters.
Ignoring UTF-8 issues in JavaScript	Use TextEncoder/TextDecoder or Buffer for Unicode-safe encoding.
Embedding large images as data URIs	Use data URIs only for small assets; large Base64 strings bloat HTML/CSS and caching.
Comparing JWT parts to normal Base64	JWT uses Base64URL, often without padding.

Base64 Quick Reference

Scenario	Best Choice	Base64 Helpful?	Note
Encode small SVG icon in CSS	Data URI or external file	Sometimes	For SVG, URL-encoded plain SVG can be smaller than Base64.
Send PDF in JSON API	Base64 field or multipart upload	Yes	Multipart is often better for large files.
Hide password in config	Do not use Base64	No	Use a secret manager or encryption.
JWT payload inspection	Base64URL decode	Yes	Decode for debugging, verify before trusting.
URL token parameter	Base64URL	Yes	Avoid +, /, and = in raw URLs.
Hash display in logs	Hex or Base64URL	Depends	Hex is easier for humans; Base64 is shorter.

Frequently Asked Questions

What is Base64 encoding?

Base64 is a binary-to-text encoding scheme. It converts arbitrary bytes into a string made from a limited set of printable ASCII characters, making the data safer to move through text-based systems such as JSON, HTML, email, and HTTP headers.

How does Base64 work?

Base64 reads bytes in groups of three. Three bytes contain 24 bits. Those 24 bits are split into four 6-bit values, and each 6-bit value maps to one character in the Base64 alphabet.

Is Base64 encryption?

No. Base64 is encoding, not encryption. It is designed for representation and transport, not secrecy. Anyone can decode a Base64 string with a standard decoder.

Why does Base64 increase file size?

Base64 converts 3 bytes into 4 text characters. That creates roughly 33% overhead before compression and metadata. This is why Base64 is convenient but not free.

What does = mean in Base64?

The = character is padding. It appears when the input byte length is not divisible by 3. Padding helps make the encoded output length a multiple of 4 characters.

What is Base64URL?

Base64URL is a URL- and filename-safe variant defined in RFC 4648. It replaces + with - and / with _. Padding is often omitted in token formats such as JWT.

Can Base64 encode images and PDFs?

Yes. Base64 can represent any binary file, including images, PDFs, ZIP files, and certificates. For large files, direct upload or multipart form data is usually more efficient than placing Base64 inside JSON.