Base64 is one of those things developers use constantly and rarely stop to explain. It's not compression, and it's not encryption — it's a way to represent binary data using only 64 printable ASCII characters (A-Z, a-z, 0-9, +, /), which matters because a lot of systems (email, JSON, URLs, older text protocols) were only designed to safely carry text, not raw binary.
How it works, briefly
Base64 takes binary data 3 bytes (24 bits) at a time and re-packs it into 4 groups of 6 bits each, mapping each 6-bit value to one of 64 printable characters. Because 6-bit groups can only represent 64 distinct values, and standard text encoding uses printable ASCII, the output is safe to embed inside plain text — no risk of a stray binary byte being misinterpreted as a control character or breaking a text-based protocol.
The trade-off: Base64 output is about 33% larger than the original binary, since 3 bytes of input become 4 bytes of output.
Where it actually shows up
- Data URIs — embedding a small image directly in HTML/CSS as data:image/png;base64,... instead of a separate file request
- Email attachments — MIME requires attachments to be encoded as text, so binary files get Base64-encoded before being included in the message
- Basic Auth headers — the username:password pair in an HTTP Authorization: Basic header is Base64-encoded (not encrypted — see below)
- JWT tokens — the header and payload segments of a JSON Web Token are Base64URL-encoded (a URL-safe variant)
- Storing binary data in JSON or XML, which have no native binary type
The mistake people make: assuming it's secure
Base64 is an encoding, not encryption. There's no key, no secret, and no security property whatsoever — decoding it is a lookup-table operation anyone can perform instantly, including in a browser console with atob(). If you see credentials, tokens, or personal data as a Base64 string, treat it as fully readable plain text, not as protected data. This trips people up specifically with HTTP Basic Auth, where the credentials are Base64-encoded (to survive being sent as an HTTP header) but not encrypted — which is exactly why Basic Auth should only ever be used over HTTPS.
Standard vs. URL-safe Base64
Standard Base64 uses + and / as two of its 64 characters, both of which have special meaning in URLs. URL-safe Base64 (used in JWTs and many web APIs) substitutes - and _ instead, and typically omits the trailing = padding characters, so the encoded output can be dropped directly into a URL or query string without additional escaping.
This tool encodes and decodes both text and files entirely in your browser — handy for quickly checking what's inside a Base64 blob you've found in a config file, an API response, or a data URI, without pasting potentially sensitive data into a third-party site.