Base64 explained: what it is and when to use it

You've seen it: a wall of letters ending in ==. Base64 is everywhere — data URLs, email attachments, API tokens — yet it's widely misunderstood. Two facts up front: it makes data bigger, and it is not encryption.

The problem Base64 solves

Lots of systems were built to carry text, not raw bytes: email, JSON, URLs, HTML. If you need to shove an image or any binary file through a text-only channel, you must first represent those bytes using safe text characters. That's all Base64 does: it maps every 3 bytes of data onto 4 characters from a 64-character alphabet (A–Z, a–z, 0–9, +, /), padding the end with =.

Two things everyone gets wrong

• It's not encryption. Base64 is a reversible public encoding — anyone can decode it instantly. Never "protect" a password or secret by Base64-encoding it.
• It inflates size by ~33%. Three bytes become four characters. Encoding large files as Base64 makes them a third bigger — that's the trade for text-safety.

When Base64 is the right tool

1. Data URLs — embedding a small icon directly in CSS/HTML (data:image/png;base64,…) to save a network request. Good for tiny images; bad for big ones (remember the 33%).
2. JSON payloads — APIs that must carry a file inside a JSON body encode it as Base64, since JSON can't hold raw bytes.
3. Email attachments — MIME encodes every attachment this way; it's why attachment size limits feel smaller than they should.
4. JWT tokens — the header and payload of a JWT are Base64url-encoded JSON. Decode one with the JWT Decoder and you can read it — proof again that encoding ≠ encryption.

When to avoid it

Don't Base64 large files "to be safe" — you gain nothing and pay 33%. Don't store images as Base64 in databases if you can store files properly. And never treat it as security: for that you need real encryption and strong passwords.

Base64url: the URL-safe cousin

Standard Base64 uses + and /, which break inside URLs. Base64url swaps them for - and _ and drops the padding. If a decoder rejects a token that "looks like Base64", this variant is usually why.