What Is Base64 Encoding and When Should You Use It?

What Base64 does

Base64 turns any sequence of bytes into plain text made of 64 safe characters: the letters A to Z and a to z, the digits 0 to 9, plus and slash. It exists because many systems that were built for text, such as email, URLs, JSON and HTML attributes, cannot carry raw binary data without corrupting it.

The method takes three bytes at a time, which is 24 bits, and splits them into four groups of six bits. Each group becomes one character. When the input length is not a multiple of three, the output is padded with one or two equals signs at the end.

The cost: about 33 percent more data

Because every three bytes become four characters, Base64 output is roughly one third larger than the input. A 30 KB image becomes about 40 KB of text. That overhead is the reason inlining large files as Base64 is usually a poor trade for web pages, even though it saves a request.

Where you will meet it

Base64 shows up in more places than most people expect.

• Email attachments, which use it inside the MIME format.
• Data URIs, such as small images embedded directly in CSS or HTML.
• The two parts of a JSON Web Token, which use a URL safe variant.
• HTTP Basic authentication, where the username and password are joined with a colon and encoded.
• Storing or sending small binary values, such as keys or hashes, in JSON or configuration files.

It is not encryption

Base64 offers no secrecy at all. Anyone can decode it instantly without a key, so encoding a password or token with Base64 does not protect it. The Basic authentication header is a good example: it is only acceptable over HTTPS because the encoding itself hides nothing.

If data must be private, encrypt it first and then Base64 encode the encrypted bytes if you need a text form.

URL safe Base64 and text encoding

The standard alphabet uses plus and slash, which have special meaning in URLs. The URL safe variant replaces them with minus and underscore and usually drops the trailing equals signs. If a decoded value looks like nonsense, check which variant was used.

Text must be turned into bytes before it is encoded, and the character set matters. Non English text and emoji need UTF-8. A common bug is encoding with a function that only understands single byte characters, which fails or produces output that decodes to the wrong characters. A decoder that treats the result as UTF-8 text will show you straight away whether the bytes were valid.