What is Base64 Encoding? A Complete Guide

Base64 is a binary-to-text encoding scheme that represents binary data using a set of 64 printable ASCII characters. It was designed to solve a fundamental problem in computing: how to transmit binary data over channels that only reliably support text. Whenever you embed an image in an HTML page using a data URI, send an email attachment, or include credentials in an HTTP Authorization header, Base64 encoding is working behind the scenes.

Why Base64 Exists

Many communication protocols and data formats were originally designed to handle only 7-bit ASCII text. Email (SMTP), for example, was built in an era when messages contained only English letters, digits, and punctuation. Binary data — images, executables, compressed archives — contains byte values across the full 0-255 range, including control characters that text-based systems may interpret as commands, strip out, or corrupt during transmission.

Base64 solves this by mapping every sequence of three bytes (24 bits) into four characters drawn from a safe alphabet of 64 printable characters. The result is a text string that can pass unscathed through any system that handles ASCII, at the cost of increasing the data size by approximately 33%.

The 64-Character Alphabet

The standard Base64 alphabet (defined in RFC 4648) uses the following 64 characters:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z   (indices  0-25)
a b c d e f g h i j k l m n o p q r s t u v w x y z   (indices 26-51)
0 1 2 3 4 5 6 7 8 9                                    (indices 52-61)
+                                                       (index   62)
/                                                       (index   63)

The = character is used as a padding suffix when the input length is not a multiple of three. These 65 characters (64 values plus the pad) were chosen because they are universally safe across ASCII-compatible systems.

A Brief History

The concept of encoding binary data as text predates the modern internet. Early forms appeared in the 1980s, but Base64 as we know it was formalized through a series of RFCs:

  • RFC 1421 (1993) — Privacy Enhanced Mail (PEM) introduced a Base64 encoding for securing email, establishing the core alphabet still in use today.
  • RFC 2045 (1996) — Part of the MIME (Multipurpose Internet Mail Extensions) specification, this defined Base64 as a Content-Transfer-Encoding for email attachments. MIME Base64 inserts line breaks every 76 characters, which made it practical for mail transport agents with line-length limits.
  • RFC 4648 (2006) — The definitive reference for Base64 today. It consolidated previous definitions, defined both the standard and URL-safe alphabets, and clarified padding rules. When developers say "Base64" without further qualification, they typically mean the encoding specified in RFC 4648 Section 4.

How Binary Data Becomes Text

The encoding process works on groups of three input bytes at a time:

  1. Take three bytes of input (24 bits total).
  2. Split those 24 bits into four groups of 6 bits each.
  3. Use each 6-bit value (ranging from 0 to 63) as an index into the Base64 alphabet to produce four output characters.
  4. If the input is not a multiple of three bytes, pad the output with one or two = characters so the encoded string length is always a multiple of four.

For example, the single ASCII character M (byte value 77, binary 01001101) gets padded with zero bits to fill two 6-bit groups, producing the encoded output TQ==. For a detailed walkthrough of the algorithm with a longer example, see the Base64 Encoding Explained guide.

Real-World Applications

Data URIs

Data URIs allow you to embed files directly in HTML or CSS. Instead of referencing an external image with a URL, you can inline the image data:

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..." />

This eliminates an HTTP request at the cost of a larger HTML document. It is commonly used for small icons and SVGs where the overhead of an additional network round-trip outweighs the 33% size increase.

Email Attachments (MIME)

When you attach a PDF or image to an email, your mail client encodes the binary file as Base64 text and includes it in the MIME body. The receiving client decodes it back to the original file. This is the use case that drove Base64 into mainstream adoption in the 1990s and remains one of its most common applications.

HTTP Basic Authentication

The HTTP Authorization header for Basic auth encodes the username and password as Base64:

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
// Decodes to: username:password

This is encoding, not encryption — the credentials are trivially reversible. Basic auth should only ever be used over HTTPS.

APIs and Data Transport

JSON, the lingua franca of web APIs, has no native binary type. When an API needs to transmit binary data — a file upload, a cryptographic signature, a thumbnail — Base64 is the standard approach. Fields like "avatar": "iVBORw0KGgo..." are ubiquitous in REST APIs. JSON Web Tokens (JWTs) also use a URL-safe variant of Base64 to encode their header and payload segments.

Certificates and Cryptographic Keys

PEM-format certificates and keys (the files that begin with -----BEGIN CERTIFICATE-----) store their binary DER data as Base64 text. This makes them safe to copy and paste, include in configuration files, and transmit through text-based protocols.

Limitations

33% Size Overhead

Every three bytes of input produce four bytes of output, so Base64-encoded data is roughly 33% larger than the original. For large files, this overhead is significant. A 3 MB image becomes approximately 4 MB when Base64-encoded. For this reason, Base64 is best suited for small payloads or situations where the convenience of text transport justifies the cost.

Base64 Is Not Encryption

This is perhaps the most common misconception. Base64 is a reversible encoding, not a security mechanism. Anyone can decode a Base64 string instantly — no key, no password, no secret is required. Using Base64 to "hide" sensitive data provides zero security. If you need confidentiality, use proper encryption (AES, ChaCha20, etc.). For a deeper discussion of this distinction, see the Encoding vs. Encryption guide.

Not Human-Readable

While Base64 output is technically text, it is not meaningful to humans. A Base64 string like SGVsbG8gV29ybGQ= gives no visual hint of its contents (it decodes to "Hello World"). This can make debugging more difficult compared to formats like hex encoding, which at least lets experienced developers recognize byte patterns.

Related Guides

Try it now →