Base64 Encoding Demystified: How It Works and When to Use It

What Is Base64?

Base64 is an encoding scheme that converts binary data into a text string using a set of 64 ASCII characters. It was designed to safely transmit binary data over channels that only support text — like email (SMTP) or HTTP headers. The name comes from its use of a 64-character alphabet.

Base64 is not encryption. It is not compression. It is purely a binary-to-text encoding. Anyone can decode a Base64 string without any key or password.

The Base64 Alphabet

Standard Base64 (RFC 4648) uses these 64 characters:

A-Z (26 chars) + a-z (26 chars) + 0-9 (10 chars) + + / (2 chars) = 64
Padding: = (fills the output to a multiple of 4)

Each Base64 character represents exactly 6 bits of data (2^6 = 64). Since binary data is 8 bits per byte, encoding works in groups of 3 bytes (24 bits) → 4 Base64 characters (24 bits).

Step-by-Step Encoding Example

Let's encode the ASCII string Man:

Input:      M         a         n
ASCII:      77        97        110
Binary: 01001101  01100001  01101110

Group into 6-bit chunks:
010011  010110  000101  101110

Map to Base64 alphabet:
010011 = 19 → T
010110 = 22 → W
000101 = 5  → F
101110 = 46 → u

Output: TWFu

When the input length is not divisible by 3, padding = characters fill the remaining positions:

• 1 remaining byte → 2 Base64 chars + ==
• 2 remaining bytes → 3 Base64 chars + =

Base64 URL Encoding

Standard Base64 uses + and /, which have special meaning in URLs. Base64URL (RFC 4648 §5) replaces them:

• + → -
• / → _
• Padding (=) is typically omitted

Base64URL is used in JWTs, OAuth tokens, and URL-safe identifiers. If you see a token like eyJhbGciOiJIUzI1NiJ9, that's Base64URL-encoded JSON.

Common Use Cases

Email attachments (MIME)

Email protocols (SMTP) were designed for 7-bit ASCII text. Attachments (PDFs, images, executables) are binary data. MIME encoding uses Base64 to convert these binaries into safe ASCII for transmission. Your email client decodes them transparently.

Data URIs

Inline resources in HTML/CSS use the data: URI scheme with Base64:

<img src="data:image/png;base64,iVBORw0KGgo..." />
background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucy...");

This embeds the resource directly in the document, eliminating additional HTTP requests — useful for small icons or SVGs in single-page applications.

JSON Web Tokens (JWT)

The three parts of a JWT (header, payload, signature) are each Base64URL-encoded. This allows the token to be safely transmitted in HTTP headers, URL parameters, and cookie values. Note: decoding the header and payload is trivial — JWTs are not confidential unless the payload is also encrypted (JWE).

Binary data in JSON/XML APIs

REST APIs that return binary data (images, files, cryptographic values) often Base64-encode them so the response remains valid JSON/XML. For example, cryptographic public keys in JWK format are Base64URL-encoded byte arrays.

The Size Overhead

Base64 encoding always increases data size by approximately 33% (3 bytes → 4 characters). For large binary files, this overhead is significant. Consider whether transmitting raw binary (e.g., multipart form data for file uploads) is more appropriate than Base64 in high-throughput scenarios.

What Base64 Is NOT

Base64 is not encryption. Storing a password as Base64 is effectively the same as storing it in plain text. Anyone who encounters a Base64-encoded "password" can decode it in seconds.

This is a common mistake in legacy systems. If you need to protect data, use actual encryption (AES-GCM) or, for passwords, a password hashing function (bcrypt, Argon2).

Using Copynix Base64 Tool

Use the Copynix Base64 Encoder/Decoder to instantly encode or decode Base64 strings in your browser. It supports both standard Base64 and Base64URL, and handles multi-line input, binary-safe encoding, and UTF-8 text correctly — all without sending any data to a server.

Summary

Base64 encodes binary data as ASCII text using a 64-character alphabet, increasing size by ~33%. It's essential for email, data URIs, JWTs, and API payloads — any context where binary data must travel through text-only channels. Remember: Base64 is transparent encoding, not encryption. Never use it to protect sensitive data.