Base64 Encoding Explained (Without the Jargon)
Base64 shows up everywhere — email attachments, image data URIs, API tokens — but it's often misunderstood as a form of security. It isn't. Here's what it's actually for.
The problem base64 solves
A lot of systems — old email protocols, URLs, JSON, XML — were designed to safely carry plain text, not arbitrary binary data. If you try to stuff raw binary bytes (like an image file) into one of these text-only channels, you risk hitting bytes that the system misinterprets as control characters, breaking the whole message.
Base64 solves this by re-encoding any sequence of bytes into a string made up of only 64 safe characters: A–Z, a–z, 0–9, plus + and / (and = for padding). Every 3 bytes of input become 4 characters of output, so the encoded result is roughly 33% larger than the original.
Base64 is not encryption
This is the single most common misconception. Base64 is a reversible encoding, not a cipher — anyone can decode it instantly with zero secret key required, including with this site's own base64 tool. If you see a password or API key "protected" by base64, it is not protected at all; it's just reformatted. Never treat base64 as a substitute for real encryption or hashing.
Where you'll actually run into it
- Data URIs — embedding a small image directly inside CSS or HTML as
data:image/png;base64,.... - HTTP Basic Authentication — the
Authorizationheader encodesusername:passwordin base64 (again, not encrypted — this is why Basic Auth requires HTTPS). - JWTs — the header and payload segments of a JSON Web Token are base64url-encoded JSON (see our JWT decoder).
- Email attachments (MIME) — binary files are base64-encoded so they survive being routed through text-only mail servers.
The classic UTF-8 mistake
Base64 operates on raw bytes, not characters. If you naively run a browser's built-in btoa() function on text containing non-ASCII characters (accented letters, emoji, CJK text), it will throw an error or silently corrupt the output, because btoa expects each character to fit in a single byte. The fix is to first convert the string to its proper UTF-8 byte representation before encoding, and reverse that step on decode. Our base64 encoder/decoder handles this correctly out of the box, so pasting emoji or non-English text won't break it.