blog / base64

What is Base64 Encoding and When Should You Use It?

· 2 min read

Base64 is a binary-to-text encoding scheme that converts arbitrary byte arrays into printable ASCII strings. Base64 is not encryption and provides zero security by itself. Instead, it resolves a fundamental transport issue: safely passing raw binary payloads through systems originally designed exclusively for text.

Why Base64 Encoding Exists

Legacy Internet protocols (such as SMTP for email or HTTP headers) were created for 7-bit ASCII text. Binary files (images, executable binaries, PDF documents) contain byte values matching ASCII control characters or protocol delimiters. Transmitting raw binary over these channels risks data corruption or premature truncation.

Base64 solves this by converting binary data into a restricted 64-character ASCII index: A-Z, a-z, 0-9, +, and /. The equals sign (=) serves as a padding character when the byte input length is not a multiple of three.

Mathematical Mechanism (6-Bit Bitmasking)

Base64 groups input bytes into 6-bit chunks (since 2⁶ = 64). Three 8-bit bytes (24 total bits) map directly into four 6-bit Base64 index values:

Input String: "Man"
Byte Values:   77 (01001101), 97 (01100001), 110 (01101110)
24-bit Stream: 010011010110000101101110
6-bit Groups:  010011 | 010110 | 000101 | 101110
Dec Indices:   19     | 22     | 5      | 46
Base64 Output: T      | W      | F      | u -> "TWFu"

Because every 3 bytes transform into 4 output characters, Base64 encoding increases data payload size by approximately 33% (ceil(n/3) * 4).

Common Engineering Use Cases

  • Email Attachments (MIME): Multi-purpose Internet Mail Extensions use Base64 to encode attachments for transport over SMTP servers.
  • Inline Data URIs: Embedding small assets directly into HTML/CSS files: src="data:image/png;base64,iVBORw0..." to reduce HTTP request count.
  • JSON Web Tokens (JWT): Tokens use Base64URL (replacing + with - and / with _ without padding) to format JSON headers safely inside URL parameters.
  • HTTP Basic Authentication: Transmitting credentials formatted as Base64(username:password) inside HTTP Authorization headers over TLS.

Security Warnings & Anti-Patterns

Never treat Base64 as encryption or security obfuscation. Anyone can reverse a Base64 string instantly. For data confidentiality, use authenticated encryption standards such as AES-256-GCM. For password storage, use salted password hashing algorithms such as Argon2 or bcrypt.

Browser Encoding Utilities

Convert text or binary byte representations locally in your browser using the Base64 Encoder and Base64 Decoder on TextUtils.