Base64 appears everywhere — in email attachments, JWTs, API responses, and web page image tags. But what actually is it, and when should you reach for it?

What Base64 Is

Base64 is a binary-to-text encoding scheme. It converts binary data (images, files, bytes) into a string representation using 64 ASCII characters: A–Z, a–z, 0–9, +, and /. The = character is used for padding.

The result is larger than the original (about 33% larger) but is safe for text-only systems:

Hello → SGVsbG8=

Three bytes of ASCII text become four Base64 characters.

What Base64 Is Used For

1. Email Attachments (MIME)

Email was designed for 7-bit text. Base64 lets binary files travel safely through text-only mail systems. Every email attachment you’ve ever sent was Base64-encoded under the hood.

2. JWT Payloads

JSON Web Tokens use Base64URL encoding for their payload (and signature). When you decode a JWT, you’re looking at Base64URL-decoded JSON:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 → {"alg":"HS256","typ":"JWT"}

3. Data URLs for Images in CSS/HTML

Embedding images as Base64 reduces HTTP requests for small assets:

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" alt="pixel">

4. API Responses with Binary Data

Some APIs return binary data (thumbnails, PDF pages) as Base64 strings in JSON responses.

When NOT to Use Base64

Base64 is not encryption. It is trivial to decode:

SGVsbG8= → Hello

Never use Base64 to “hide” passwords, tokens, or sensitive data. It is encoding, not security.

Also avoid Base64 for large files in production payloads. The 33% size overhead adds up fast.

Base64 vs Base64URL

Standard Base64 uses + and /. URL-safe Base64 replaces these with - and _ and removes padding (=):

Standard:  SGVsbG8gd29ybGQ=
Base64URL: SGVsbG8gd29ybGQ    (no padding, URL-safe characters)

JWTs use Base64URL specifically because those characters are safe in URLs.

Quick Reference: Base64 Character Set

| Value | Char | Value | Char | |-------|------|-------|------| | 0–25 | A–Z | 26–51 | a–z | | 52–61 | 0–9 | 62 | + | | 63 | / | (pad) | = |

Summary

Base64 encodes binary data as ASCII text using 64 characters. It’s ideal for email attachments, data URLs, and JWT payloads. It is not encryption — it provides no security. Base64URL is the URL-safe variant used in web standards.

Encode and decode Base64 instantly with the Base64 Encoder/Decoder.