Base64 is a binary-to-text encoding scheme that represents binary data using 64 ASCII characters. Per RFC 4648, it's the standard way to embed binary content (images, files, certificates) in text-based formats like email, JSON, XML, and HTTP headers. Base64 is not encryption. It's a reversible encoding that anyone can decode.
Key takeaways
- Base64 encodes binary data as ASCII text using a 64-character alphabet.
- It increases data size by ~33% (3 bytes become 4 characters).
- Base64 is encoding, NOT encryption. It's fully reversible without a key.
- Used in email (MIME), JWTs, data URIs, PEM certificates, and HTTP Basic auth.
- Per RFC 4648, Base64url uses - and _ instead of + and / for URL safety.
Quick explanation
In simple terms
Base64 converts binary data (like images and files) into plain text so it can be included in emails, web pages, and other text-based formats.
Technical definition
Base64 is a binary-to-text encoding defined in RFC 4648 that maps 3 bytes (24 bits) of binary input to 4 characters from a 64-symbol alphabet (A-Za-z0-9+/), with = padding for incomplete final groups, producing a 33% size increase.
Analogy
Base64 is like translating a book written in a language with 256 letters (binary bytes) into a language with only 64 letters (Base64 alphabet). The book gets longer (33% bigger), but now it can be carried through a mail system that only handles those 64 letters.
Definition
Base64 is a binary-to-text encoding scheme that converts binary data into a 64-character ASCII alphabet. Per RFC 4648, it's used to embed binary content in text-based protocols like email, JSON, and HTTP. It's encoding, not encryption.
Base64 is a binary-to-text encoding scheme defined in RFC 4648. It converts arbitrary binary data into a string of ASCII characters using a 64-symbol alphabet: A-Z (26), a-z (26), 0-9 (10), + (1), and / (1), plus = for padding.
The encoding works by taking 3 bytes (24 bits) of input, splitting them into four 6-bit groups, and mapping each group to one Base64 character. If the input isn't divisible by 3, padding (=) fills the remaining positions. This process increases the data size by approximately 33% (4 output characters per 3 input bytes).
Why it matters
Core concepts
The Base64 alphabet
A set of 64 characters used for encoding: A-Z (0-25), a-z (26-51), 0-9 (52-61), + (62), / (63). Padding character: =.
Base64 takes 3 bytes of binary data (24 bits) and splits them into 4 groups of 6 bits. Each 6-bit group maps to one of the 64 characters. If the input isn't divisible by 3, padding (=) is added to complete the last 4-character block.
Example
The string 'Hello' encodes to 'SGVsbG8=' (5 bytes in, 8 characters out with one padding byte).
Base64url (URL-safe variant)
A URL-safe variant of Base64 that replaces + with - and / with _ to avoid URL encoding issues.
Per RFC 4648 Section 5, Base64url is identical to standard Base64 except it uses - instead of + and _ instead of /. This makes it safe for URLs, filenames, and query parameters without percent-encoding.
Example
JWT tokens use Base64url: eyJhbGciOiJIUzI1NiJ9 (no + or / characters).
How it works
Read input in 3-byte groups
The input binary data (bytes) is read 3 bytes (24 bits) at a time.
3 bytes input
Split into 6-bit values and map to characters
The 24 bits are split into four 6-bit groups. Each 6-bit value (0-63) maps to one character from the Base64 alphabet.
24 bits → 4 x 6-bit groups
Add padding for incomplete groups
If the input isn't evenly divisible by 3, padding characters (=) are appended: one = for 2 remaining bytes, two == for 1 remaining byte.
Add = padding if needed
Benefits
Safe binary transport over text protocols
Base64 converts binary data (images, files, certificates) into ASCII characters that can be safely embedded in text-based formats like JSON, XML, HTML, and email.
Universal support across all platforms
Base64 is defined in RFC 4648 and supported in every programming language and platform.
Limitations
33% size increase
MediumBase64 represents 3 bytes as 4 characters, increasing data size by approximately 33%. This matters for large files and bandwidth-constrained environments.
Workaround — For large data, compress before encoding. For APIs, use binary protocols (gRPC, Protocol Buffers) instead of Base64 in JSON.
Not encryption, not security
HighBase64 is fully reversible without a key. Per RFC 4648, it provides no confidentiality. Never use it to protect passwords, tokens, or sensitive data.
Workaround — Use TLS for data in transit, AES for data at rest. Base64 is only for text compatibility, not protection.
Examples
Email attachment encoding
An email client encodes a PDF attachment as Base64 for inclusion in a MIME message.
When you attach a file to an email, the email client Base64-encodes the file content so it can be included in the text-based MIME message. The recipient's client decodes it back to binary.
Myths, corrected
Myth
Base64 encrypts data and makes it secure
Correction
Base64 is encoding, not encryption. Per RFC 4648, it's a fully reversible transformation. Any tool can decode Base64 instantly without a key. It provides zero confidentiality.
Why it happens: Base64-encoded strings look random and unreadable to humans, creating a false sense of security. Some developers embed credentials in Base64 in config files, thinking they're protected.
Myth
Base64 is only used for encoding images
Correction
Base64 is used far beyond images: email attachments (MIME), JWT tokens, HTTP Basic authentication, PEM certificates, API request bodies, and any scenario where binary data needs to travel through text-based channels.
Why it happens: Data URIs for inline images (data:image/png;base64,...) are the most visible use case in web development.
Practical implications
For admins
Recognize Base64-encoded data in logs and configuration files. Know how to decode it for troubleshooting (PowerShell, base64 CLI, browser dev tools).
For security
Audit for Base64-encoded credentials in config files, environment variables, and source code. Base64 provides zero protection. Replace with proper secrets management.
Related terms
MIME
Multipurpose Internet Mail Extensions, which uses Base64 for email attachment encoding.
Base64url
URL-safe Base64 variant using - and _ instead of + and /, per RFC 4648 Section 5.
JWT
JSON Web Token, which uses Base64url encoding for its header, payload, and signature.
Frequently asked questions
Is Base64 encryption?
No. Base64 is encoding, not encryption. Per RFC 4648, it's a fully reversible transformation. Anyone can decode a Base64 string without a key. Never use it to protect sensitive data.
Why does Base64 increase file size?
Base64 increases data size by approximately 33% because it represents 3 bytes of binary as 4 ASCII characters (6 bits per character vs 8 bits per byte).
Where is Base64 used?
Email attachments (MIME), data URIs in HTML/CSS, JWT tokens, HTTP Basic authentication headers, PEM certificate files, and embedding binary data in JSON/XML payloads.
How do I encode and decode Base64?
PowerShell: [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Hello')). Linux: echo -n 'Hello' | base64. JavaScript: btoa('Hello'). Python: base64.b64encode(b'Hello').
Conclusion
Base64 encodes binary data into a 64-character ASCII alphabet for safe transport over text-based protocols. Per RFC 4648, it's used in email attachments (MIME), data URIs, JWT tokens, Basic authentication headers, and certificate files (PEM format).
Base64 is encoding, not encryption. Anyone can decode a Base64 string. Never use it to protect sensitive data. The ~33% size increase is the trade-off for text compatibility.
Main takeaway
Explore Base64url (URL-safe variant used in JWTs), percent-encoding for URLs, and MIME for email attachment encoding.
