Base64 Explained
If you have worked with APIs, emails or web pages, you have almost certainly seen a long string of seemingly random letters and numbers ending in one or two equals signs. That is Base64 — one of the most widely used encodings on the internet.
This guide explains what Base64 is, why it exists and when to reach for it.
What Base64 actually does
Base64 is an encoding, not encryption. It converts binary data (or text) into a string made up of only 64 safe characters: A–Z, a–z, 0–9, plus "+" and "/". This makes the data safe to travel through systems that only reliably handle plain text.
Because it maps 3 bytes to 4 characters, Base64 makes data roughly 33% larger. The trailing "=" characters are padding so the length is always a multiple of four.
Where you will see it
Data URIs embed small images or fonts directly in HTML or CSS as Base64, avoiding an extra network request. Email attachments are Base64-encoded so binary files survive text-based mail servers. JSON and API tokens (including the payload of a JWT) often carry Base64 data because JSON is a text format.
In short, Base64 shows up anywhere binary data needs to pass through a text-only channel.
When not to use it
Do not use Base64 for security. It is trivially reversible — anyone can decode it in seconds — so it hides nothing. If you need to protect data, encrypt it.
Avoid Base64 for large files where a binary transfer is possible, because the 33% size increase is wasteful. It is best for small payloads and for situations where only text can be transmitted.
Frequently asked questions
Is Base64 encryption?
No. It is an encoding that anyone can reverse instantly. It provides no security — use encryption for that.
Why does Base64 end in "="?
The equals signs are padding that make the encoded length a multiple of four characters.
Does Base64 make data bigger?
Yes, by about 33%, because every 3 bytes become 4 characters.
Can Base64 handle emoji and accents?
Yes, as long as the text is encoded as UTF-8 first, which good tools do automatically.