Base64 Encoding: A Beginner's Explainer

Base64 gets mistaken for encryption or compression more often than any other encoding scheme — understandably, since the output looks like scrambled gibberish. It's neither; it's a straightforward, fully reversible translation between binary data and plain text characters.

What Base64 actually does

Base64 converts binary data into a string using only 64 safe, printable characters (A-Z, a-z, 0-9, +, /), making it possible to embed binary data — like an image — inside text-based formats like JSON, XML, or a URL, which can't natively contain arbitrary binary bytes.

Why the encoded output is larger, not smaller

Base64 encoding increases data size by roughly 33%, because it repackages every 3 bytes of binary data into 4 text characters. This surprises people who assume "encoding" implies compression — Base64's job is compatibility, not size reduction, and it actively trades size for portability.

Common places Base64 shows up

• Data URIs. Small images embedded directly in HTML/CSS as data:image/png;base64,... instead of a separate file request.
• Email attachments. Email protocols were originally text-only, so binary attachments are Base64-encoded to travel safely through them.
• API tokens and Basic Auth headers. HTTP Basic Authentication encodes credentials as Base64 (note: encoded, not encrypted — anyone can decode it, so it's only safe over HTTPS).

A crucial security clarification

Base64 provides zero confidentiality — decoding it requires no key or password, just running it through any Base64 decoder. It should never be treated as a way to protect sensitive data; it's purely a format conversion, not a security mechanism.

Frequently asked questions