What Is Base64? A Plain-English Guide

Base64 is everywhere: data URLs in CSS, attachments in email, tokens in authentication headers and binary values inside JSON. It is also widely misunderstood. Base64 is an encoding, not encryption, and it is not a compression format.

Text versus binary

Computers store all data as bytes. Text is a layer on top: a character encoding such as UTF-8 decides which bytes represent which characters. Many protocols were designed to carry text, not arbitrary bytes. Base64 bridges that gap by turning any byte sequence into a restricted set of printable ASCII characters.

How the encoding works

Base64 takes three bytes at a time and represents them with four characters from a 64-character alphabet: A–Z, a–z, 0–9, plus + and /. Three bytes is 24 bits. Four Base64 characters, at six bits each, also carry 24 bits. Nothing is lost.

Input	Bytes	Base64
M	4D	TQ==
Ma	4D 61	TWE=
Man	4D 61 6E	TWFu

When the input length is not a multiple of three, the encoder pads the final group with zero bits and adds = characters to show how many bytes were missing. One = means one byte of padding; two mean two.

URL-safe Base64

Standard Base64 uses + and /, which have special meanings in URLs. The URL-safe variant replaces them with - and _, and often removes the = padding. JSON Web Tokens use this variant for their header and payload segments.

If you paste URL-safe Base64 into a decoder, it should accept it. If a decoder rejects it, check whether you need to convert - and _ back to + and / and restore the padding.

What Base64 is not

• It is not encryption. Anyone can decode it. Use encryption and HTTPS for confidentiality.
• It is not compression. It usually makes data about 33% larger.
• It is not a security boundary. Encoding a secret in Base64 does not hide it.
• It is not human-readable. It is text, but it is not meant to be read by people.

Where you see it

• Data URLs. Small images and fonts can be embedded in CSS or HTML as data:image/png;base64,....
• Email attachments. MIME encodes binary attachments as text for transport.
• JSON and XML. A text format can carry binary data as a Base64 string.
• HTTP Basic authentication. The username and password are joined and Base64-encoded. This is not secure without HTTPS.
• JSON Web Tokens. The header and payload are URL-safe Base64 encoded. The signature is separate.

Encode text correctly

Base64 operates on bytes, not characters. If you encode text, convert it to bytes first. UTF-8 is the right default for the web. The NelcByte Base64 encoder does this for you and reports an error if decoded bytes are not valid UTF-8.

If you see garbled characters after decoding, the original data may have used a different encoding, or the Base64 may have been truncated.

Common problems

• Line breaks. Some Base64 output is wrapped across lines. Remove the whitespace before decoding if a tool rejects it.
• Missing padding. Some decoders require the = characters; others do not. Add them if necessary.
• Double encoding. If a value already looks like Base64, check before encoding it again.
• Mixed alphabets. Standard and URL-safe Base64 use different characters for the same positions. Convert before decoding.
• Invalid UTF-8. The bytes may be valid Base64 but not valid text. Treat them as binary instead.

When to use it, and when not to

Use Base64 when a text-only channel must carry binary data and the payload is small. Do not use it for large images, downloads or database blobs without a good reason. Do not use it to protect secrets. If a value needs to be secret, encrypt it; if it needs to be verified, sign it.

A quick checklist

1. Decide whether you are encoding text or binary.
2. Use UTF-8 for text.
3. Choose standard or URL-safe output based on where the value will travel.
4. Keep the padding unless the receiving system says otherwise.
5. Remember that Base64 is not encryption.