If you have ever inspected a web page's HTML and seen a long string of random-looking letters and
numbers inside an <img> tag, you have probably encountered Base64 encoding. It is
everywhere in modern computing, yet rarely explained clearly. This guide will fix that.
What Is Base64?
Base64 is a method of encoding binary data as plain text. It converts any sequence
of bytes — an image, a PDF, a piece of audio — into a string of 64 printable ASCII characters
(letters A–Z, a–z, digits 0–9, plus + and /, with = for
padding).
Why Does Base64 Exist?
Many systems and protocols were originally designed to handle only plain text. Email (SMTP), HTML, JSON, and XML are all text-based. When you need to send binary data through a text-only channel without corruption, you encode it as Base64 first.
- Email attachments: MIME standard encodes file attachments as Base64 before sending them
- Data URLs in HTML/CSS: Embedding small images directly in code as
data:image/png;base64,... - JSON APIs: Sending binary file data inside a JSON field (which only accepts text)
- JWTs: JSON Web Tokens use Base64URL (a URL-safe variant) to encode the token payload
- Storing images in databases: Some developers store small images as Base64 text columns
How Does Base64 Encoding Work?
Base64 works by taking 3 bytes of binary data (24 bits) and splitting them into 4 groups of 6 bits each. Each 6-bit group maps to one of the 64 characters in the Base64 alphabet. This is why Base64-encoded output is always approximately 33% larger than the original binary data.
Binary: 01001000 01101001
Base64 encoded: SGk=
Original: data:image/png;base64,iVBORw0KGgo...
Base64 Is Not Encryption
⚠️ Important distinction: Base64 is encoding, not encryption. Anyone can instantly decode a Base64 string back to its original form — no key or password is needed. Never use Base64 to "hide" sensitive data like passwords. Use proper encryption algorithms for that.
Base64 vs. Base64URL
Standard Base64 uses + and / characters which have special meaning in URLs.
Base64URL replaces them with - and _ respectively, making it safe for use
in web addresses and HTTP headers. This variant is used in JWTs and OAuth tokens.
How to Encode and Decode
In JavaScript: btoa('hello') encodes to Base64, and atob('aGVsbG8=')
decodes back. In Python: import base64 then base64.b64encode(b'hello').
For images: a free online Base64 encoder tool handles this instantly without writing any code.