Base64 Encoding Explained (With Real Examples)
What Base64 is, when to use it, and when to reach for something better — with worked examples and gotchas.
What Base64 actually does
Base64 encodes binary data as an ASCII string using 64 printable characters. It's not encryption, not compression, and not obfuscation — it's a way to move binary through text-only channels safely.
The classic use case is email attachments: SMTP was designed for 7-bit ASCII, so binaries have to be encoded before they can travel through it. Base64 is the standard.
When to use Base64
Data URIs
Embedding a small image directly into HTML or CSS with 'data:image/png;base64,...'. Great for icons under 4KB; wasteful for larger files.
JSON payloads with binary fields
APIs that need to include binary data in a JSON body (a signature, a small file) usually Base64-encode it.
Basic Auth headers
The old 'Authorization: Basic ...' header contains a Base64-encoded 'user:password' pair. Not secure — use over HTTPS only.
When NOT to use Base64
Any time you can send raw binary. Base64 inflates size by ~33%, so large files become measurably slower.
Any time you need actual security. Base64 is trivially decoded by anyone — it's encoding, not encryption.
Common gotchas
URL-unsafe characters: the standard Base64 alphabet includes '+' and '/', which need escaping in URLs. Use URL-safe Base64 (which swaps them for '-' and '_') for query strings.
Padding: Base64 output is padded with '=' to a multiple of 4 characters. Some decoders are strict about this; some don't care.
Line breaks: some legacy tools wrap Base64 output at 76 characters. If your decoder complains, strip whitespace first.
Key takeaways
Base64 is transport, not security. It only converts binary to text.
It inflates size by a third — use it for small payloads or when raw binary isn't an option.
Watch out for URL safety, padding and line breaks when interoperating with strict decoders.
Frequently asked questions
- Is Base64 secure?
- No. Anyone can decode it in one line. Use it for encoding, not for privacy.
- How much bigger does data get?
- About 33% larger, plus optional line breaks.
- Can I Base64 encode Unicode text?
- Yes — encode the UTF-8 byte sequence, then Base64 the bytes. Most tools handle this transparently.
- What is URL-safe Base64?
- A variant that replaces '+' with '-' and '/' with '_' so the string is safe in URLs without escaping.
- Should I use Base64 for images in production?
- Only for tiny icons where an HTTP request would cost more than the extra bytes.
- Why do Base64 strings end with '='?
- It's padding to make the output length a multiple of 4 characters.
We build and document free, privacy-first browser tools used by writers, students, marketers and developers. Every article is written and reviewed by the same team that ships the tools.
Expertise: Writing workflows, SEO content, text processing, front-end performance
- Last updated:
- Reading time:
- 4 min