What Is Base64?
Base64 is an encoding scheme that converts binary data into a string of 64 printable ASCII characters. Those 64 characters are: A-Z, a-z, 0-9, +, and /, plus = as a padding character.
It was designed to solve a specific problem: many transport protocols and storage systems were built to handle text, not arbitrary binary data. When you need to move binary content (images, files, keys) through a text-only channel, Base64 is the standard solution.
Every 3 bytes (24 bits) of input become 4 output characters. This means a Base64-encoded string is roughly 33% larger than the original binary. The process is deterministic and fully reversible, it is an encoding, not encryption, and anyone can decode a Base64 string back to the original bytes.
Base64 Variants: Standard, URL-Safe, and MIME
Not all Base64 is identical. There are three main variants in common use:
Standard Base64 (RFC 4648, Section 4)
Uses + and / as the 62nd and 63rd characters, with = padding. This is what you get from the classic specification and what most libraries produce by default. It is safe for file storage but not for URLs.
Base64URL (RFC 4648, Section 5)
Replaces + with - and / with _, and typically omits padding. The result can appear in URL query strings and path segments without percent-encoding. This is the variant used by JSON Web Tokens (JWTs) and is the correct choice whenever the output will appear in a URL or HTTP header.
MIME Base64 (RFC 2045)
Identical character set to standard Base64, but output is split into lines of at most 76 characters, each terminated by CRLF (\r\n). This is the format used for email attachments. If you paste a MIME Base64 block into a standard decoder you may need to strip the line breaks first.
Choosing the wrong variant is a common source of bugs. When in doubt: JWTs and URLs need Base64URL; email attachments need MIME; everything else uses standard.
Common Use Cases
Embedding images in HTML or CSS Instead of linking to an external image file, you can embed it directly as a data URI:
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUh..." />
This removes one HTTP request, which can speed up small icons or inline images. The trade-off: the HTML file becomes larger, the image cannot be cached independently, and the approach does not scale past a few kilobytes.
JSON Web Tokens (JWTs) JWTs encode their header and payload as Base64URL strings separated by dots. The header identifies the algorithm; the payload carries claims (user ID, roles, expiry). In UK fintech, Open Banking APIs, payment services, identity providers, JWTs are the standard bearer token format. The signature is also Base64URL-encoded but is cryptographically signed, not just encoded.
Email attachments (MIME) Email protocols were originally plain text. MIME uses Base64 to encode binary attachments, PDFs, images, Word documents, so they travel safely through mail infrastructure built for ASCII.
HTTP Basic Authentication
Credentials are sent as username:password encoded in standard Base64:
Authorization: Basic dXNlcjpwYXNzd29yZA==
Binary data in JSON or databases JSON has no native binary type. Base64 is the standard way to include binary blobs (icons, cryptographic keys, file content) inside a JSON payload or a text column in a relational database.
What Base64 Is NOT (NCSC Guidance)
The UK's National Cyber Security Centre (NCSC) is explicit on this point: encoding is not the same as encryption. Encoding transforms data into a different representation using a publicly known, reversible scheme. Encryption protects data so that only authorised parties can read it.
Base64 provides zero security. A Base64-encoded password is as exposed as a plaintext password, it just looks different. Confusing the two has led to real security incidents where developers believed Base64 was "obscuring" sensitive data.
Specifically:
- Base64 is not encryption. Never use it to protect sensitive data.
- Base64 is not compression. Output is always larger than input.
- Base64 is not hashing. It is fully reversible; hashing is a one-way function.
- Base64 is not a signature. It does not verify that data has not been tampered with.
If you need to protect data, use proper encryption (AES-256-GCM for symmetric, RSA or elliptic curve for asymmetric). If you need to verify integrity, use HMAC or a digital signature. Base64 serves neither purpose.
Practical Base64 in Browser APIs
Every modern browser exposes two built-in functions for Base64:
// Encode a string to Base64
const encoded = btoa("Hello, world!");
// Result: "SGVsbG8sIHdvcmxkIQ=="
// Decode a Base64 string
const decoded = atob("SGVsbG8sIHdvcmxkIQ==");
// Result: "Hello, world!"
btoa (binary to ASCII) and atob (ASCII to binary) work on strings. For binary files or Uint8Array data, you need to convert first:
// Encode a Uint8Array (e.g. from a File object)
function arrayBufferToBase64(buffer) {
const bytes = new Uint8Array(buffer);
let binary = "";
for (let i = 0; i < bytes.byteLength; i++) {
binary += String.fromCharCode(bytes[i]);
}
return btoa(binary);
}
For URL-safe Base64 in the browser, replace + with - and / with _ after encoding:
const urlSafe = btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
In Node.js (server-side JavaScript), use Buffer.from(str).toString("base64") for encoding and Buffer.from(encoded, "base64").toString("utf8") for decoding. Python uses base64.b64encode(bytes) and base64.b64decode(str).
When to Use (and When Not to Use) Base64
Use Base64 when:
- A protocol or system requires text-safe binary representation (MIME email, JSON, XML)
- Building data URIs for small embedded assets
- Working with JWTs or other token formats that specify Base64URL
- Storing binary data in a text database column
Do not use Base64 when:
- You want to protect data (use encryption instead)
- You want to reduce file size (use gzip or Brotli compression instead)
- You are transferring large files (the 33% overhead adds up quickly, a 10 MB file becomes 13.3 MB encoded)
- You want to verify data integrity (use HMAC or a digital signature instead)
The Base64 Encoder/Decoder on this site works entirely client-side, your data is not sent to any server.