What Is Base64? How It Works, When to Use It, and Pitfalls

Base64 is an encoding that lets binary data — like images or keys — travel safely as plain text. It is used for email attachments, data URLs that embed images directly in HTML, JWT payloads, and anywhere only text is allowed. This guide explains how it works and the practical pitfalls to watch for.

How Base64 works

Computer data comes in 8-bit bytes, but Base64 regroups it into 6-bit chunks. It splits 3 bytes (24 bits) into four 6-bit groups and maps each to one of 64 characters (A–Z, a–z, 0–9, + and /). Because 3 bytes become 4 characters, the data grows by roughly 4/3 — about 33%.

When the length is not a multiple of 3, one or two = characters are appended as padding to align the length. The = is not a broken symbol; it is a valid part of Base64.

A common myth: Base64 is not encryption

The most important caveat is that Base64 is not encryption. There is no key, and anyone can reverse it instantly. Encoding a password or personal data as Base64 does not hide it. To protect secrets, you need actual encryption (TLS or a proper cryptographic algorithm).

Standard vs. URL-safe Base64

Standard Base64 uses + and /, which have special meaning in URLs and can break when placed there directly. The "URL-safe" variant replaces + with - and / with _. JWTs use the URL-safe form. Be mindful of which variant a given context expects.

When to use it

• Carrying binary through text-only channels (email attachments, data URLs)
• Embedding small images directly in HTML/CSS to cut request count
• Inspecting a JWT header/payload (URL-safe Base64)
• Storing a binary value as a string in a config file

To try it, use our Base64 encoder/decoder — it converts text and Base64 both ways entirely in your browser, so your input never leaves your device. Pair it with the JWT decoder to inspect tokens, or the URL encoder when handling URL parameters.