What Is Base64? How It Works, When to Use It, and Pitfalls

Base64 is an encoding that lets binary data — like images or keys — travel safely as plain text. It is used for email attachments, data URLs that embed images directly in HTML, JWT payloads, and anywhere only text is allowed. This guide explains how it works and the practical pitfalls to watch for.

How Base64 works

Computer data comes in 8-bit bytes, but Base64 regroups it into 6-bit chunks. It splits 3 bytes (24 bits) into four 6-bit groups and maps each to one of 64 characters (A–Z, a–z, 0–9, + and /). Because 3 bytes become 4 characters, the data grows by roughly 4/3 — about 33%.

When the length is not a multiple of 3, one or two = characters are appended as padding to align the length. The = is not a broken symbol; it is a valid part of Base64.

A common myth: Base64 is not encryption

The most important caveat is that Base64 is not encryption. There is no key, and anyone can reverse it instantly. Encoding a password or personal data as Base64 does not hide it. To protect secrets, you need actual encryption (TLS or a proper cryptographic algorithm).

Standard vs. URL-safe Base64

Standard Base64 uses + and /, which have special meaning in URLs and can break when placed there directly. The "URL-safe" variant replaces + with - and / with _. JWTs use the URL-safe form. Be mindful of which variant a given context expects.

Size grows about 1.33x

Base64 represents 3 bytes with 4 characters, so the result is about 33% larger than the original. Embedding a small image as a data URL saves an HTTP request and helps, but for large images the added size can actually slow rendering. Embedding suits small, frequently reused assets like icons.

What the padding (=) means

The trailing = is padding that rounds the output length up to a multiple of 4 characters; 0 to 2 are added depending on the input length. The URL-safe variant sometimes omits =, in which case the decoder infers the length. That is why you see JWTs whose Base64 has no =.

When to use it

• Carrying binary through text-only channels (email attachments, data URLs)
• Embedding small images directly in HTML/CSS to cut request count
• Inspecting a JWT header/payload (URL-safe Base64)
• Storing a binary value as a string in a config file

To try it, use our Base64 encoder/decoder — it converts text and Base64 both ways entirely in your browser, so your input never leaves your device. Pair it with the JWT decoder to inspect tokens, or the URL encoder when handling URL parameters.