What is Base64?
Base64 is an encoding scheme that converts binary data into ASCII text using 64 printable characters. Standardized in RFC 4648, it is used wherever binary data must travel through text-only channels: email attachments (MIME), web Data URIs, JWT tokens, HTTP Basic Authentication, and API payloads.
A critical distinction: Base64 is encoding, not encryption. Anyone can decode it to recover the original data. For sensitive information, use encryption algorithms like AES or RSA.
How Encoding Works
Base64 splits input into 6-bit groups and maps each to one of 64 characters (A-Z, a-z, 0-9, +, /). Three input bytes (24 bits) become four Base64 characters, resulting in approximately 33% size increase. When input length isn't a multiple of 3, padding characters (=) are appended: one = for 2-byte input, two == for 1-byte input.
Standard vs URL-safe Base64
Standard Base64 (RFC 4648 §4) uses + and /, which conflict with URL syntax — + means space and / is a path separator. URL-safe Base64 (RFC 4648 §5) replaces them with - and _, and typically omits padding. JWT tokens, OAuth parameters, and filename-safe encoding all use the URL-safe variant.
Practical Use Cases
JWT (JSON Web Token)
JWT consists of three Base64url-encoded segments separated by dots (Header.Payload.Signature). Decoding the Payload reveals claims like user ID, expiration (exp), and issued-at (iat) timestamps. For API debugging, decode the Payload and convert the exp value using a Timestamp Converter to check token validity.
Data URIs (Inline Images)
Data URIs embed resources directly in HTML/CSS as data:[MIME type];base64,[data]. Small icons (under 2-5 KB) inlined this way reduce HTTP requests and improve initial load times. However, larger images increase HTML/CSS file sizes dramatically and lose browser caching benefits. Use the Image Base64 Converter for Data URI generation.
HTTP Basic Authentication
HTTP Basic Auth transmits username:password Base64-encoded in the Authorization: Basic [string] header. Simple but offers no confidentiality — always use HTTPS. On plain HTTP, network sniffing exposes credentials immediately.
Email Attachments (MIME)
SMTP was originally designed to support only 7-bit ASCII. MIME uses Base64 to convert binary attachments (images, documents) into text form for email transmission. Receiving email clients automatically decode and restore original files.
API Payloads
When uploading images via JSON APIs, file content can be Base64-encoded into a string field. Simpler than multipart forms, but the 33% size overhead makes it unsuitable for large files. For large uploads, use multipart upload or pre-signed URL approaches instead.
Language-Specific Usage
JavaScript (Browser) uses btoa() for encoding and atob() for decoding. These functions only support Latin-1 characters, so UTF-8 strings (including CJK characters) require combining with encodeURIComponent(). Node.js uses Buffer.from(data).toString('base64').
Python uses the base64 module's b64encode() and b64decode(). URL-safe variants use urlsafe_b64encode(). Input must be bytes type — convert strings with .encode('utf-8') first.
Java uses java.util.Base64 class with getEncoder()/getDecoder(). URL-safe variant uses getUrlEncoder().
Important Caveats
Not encryption — Base64 is reversible encoding. Never rely on it to protect passwords, API keys, or sensitive data.
Size overhead — Output is ~33% larger than input. For large files, consider multipart upload or pre-signed URLs.
Padding inconsistency — MIME requires padding (=); JWT omits it. Padding mismatch is a common cause of decode failures.
Line break handling — MIME Base64 inserts line breaks every 76 characters; URL-safe Base64 uses none. Mixing conventions causes errors.
Tools
Encode/decode text with the Base64 Encoder. Convert images to Data URIs with the Image Base64 Converter. Check JWT token expiration by decoding Base64 then converting the exp value with the Timestamp Converter.