What is Base64 Encoding?

The short answer

Base64 is a way to encode binary data (like images, files, or arbitrary bytes) into a string of plain text characters. It takes any data and represents it using only 64 safe characters: A–Z, a–z, 0–9, +, and /.

Base64 is not encryption — it is just encoding. Anyone can decode a Base64 string back to its original data instantly. Its purpose is to safely transmit binary data through systems that only handle text.

Why does Base64 exist?

Many protocols and systems were originally designed to handle only ASCII text — email (SMTP), HTTP headers, HTML attributes, and URL query strings. When you need to pass binary data (like an image or a PDF) through these systems, you need to convert it to text first.

Base64 solves this problem by providing a universal, reversible way to turn any binary data into a safe text string.

How it works

Base64 takes 3 bytes (24 bits) of input at a time and converts them into 4 Base64 characters. Each Base64 character represents 6 bits of data.

Example: encoding the string "Hi!"

Text:    H        i        !
ASCII:   72       105      33
Binary:  01001000 01101001 00100001
Base64:  SGkh

Notice the output is always longer than the input — Base64 encoding increases the data size by approximately 33%.

Common use cases

• Email attachments — the MIME standard uses Base64 to encode file attachments so they can travel through email servers
• Inline images in HTML/CSS — <img src="data:image/png;base64,..."> embeds images directly without a separate HTTP request
• JSON Web Tokens (JWT) — the header and payload sections of a JWT are Base64URL encoded (a variant of Base64)
• API authentication — HTTP Basic Auth sends credentials as Base64: Authorization: Basic dXNlcjpwYXNz
• Storing binary data in JSON — since JSON only supports text, binary blobs are often Base64-encoded before being stored

Base64 vs Base64URL

Standard Base64 uses + and / which have special meaning in URLs. Base64URL is a variant that replaces these with - and _ to make the output safe for use in URLs and filenames. JWTs use Base64URL.

Encoding and decoding in code

In JavaScript (browser):

// Encode
const encoded = btoa('Hello, world!');
// "SGVsbG8sIHdvcmxkIQ=="

// Decode
const decoded = atob('SGVsbG8sIHdvcmxkIQ==');
// "Hello, world!"

In Python:

import base64

# Encode
encoded = base64.b64encode(b'Hello, world!').decode()
# "SGVsbG8sIHdvcmxkIQ=="

# Decode
decoded = base64.b64decode('SGVsbG8sIHdvcmxkIQ==').decode()
# "Hello, world!"

The padding character =

You often see one or two = characters at the end of a Base64 string. This is padding. Since Base64 processes data in groups of 3 bytes, if the input length is not a multiple of 3, padding is added to fill the last group. One = means one byte of padding was added, two == means two bytes.