Base64 turns up everywhere once you start noticing it — in data URIs, email attachments, tokens, and configuration files. It has a reputation for being mysterious, but the idea behind it is simple, and understanding it clears up a common and important misconception about what it does and does not protect.
The problem it solves
Computers store everything as bytes, and many bytes have no printable character. That is fine inside a program, but a problem the moment data has to travel through a channel built for text — the body of an email, a URL, a JSON string, an HTML attribute. Send raw binary through those and it can be mangled or rejected. Base64 exists to make any binary data safe to carry as plain text.
How the encoding works
Base64 uses an alphabet of 64 characters: the letters A–Z and a–z, the digits 0–9, and two extra symbols. It takes the input three bytes at a time — 24 bits — and re-slices those 24 bits into four groups of six. Each six-bit group, which can hold 64 possible values, maps to one character in the alphabet. So every three bytes of input become four characters of output. When the input does not divide neatly into threes, padding characters fill the gap.
Why it gets bigger
Turning three bytes into four characters means the encoded form is about a third larger than the original. That overhead is the price of text-safety, and it is worth remembering when deciding whether to inline data. For a tiny icon the cost is trivial; for a large file it can be significant, which is one reason Base64 suits small assets rather than big ones.
Standard and URL-safe alphabets
There are two common variants. The standard alphabet uses + and / as its two extra characters, which is fine in most contexts but awkward in URLs, where those characters have special meaning. The URL-safe variant swaps them for - and _ so the encoded string can sit in a web address without being misread. The two are otherwise identical, but decoding one with the wrong alphabet fails, so it is worth knowing which a system expects.
The crucial misconception
Base64 is not encryption, and it provides no secrecy whatsoever. Anyone can decode a Base64 string back to the original bytes with no key and no effort. It only changes the representation of data, not its confidentiality. Treating a Base64 string as if it hides a secret is a real and recurring security mistake — a token or password that is “just Base64” is effectively in the open.
When to reach for it
Base64 shines when binary data must live inside a text format: inlining a small image as a data URI to save a request, embedding a font, or encoding a payload that has to pass through a text-only channel. It is the wrong tool when size matters and the data is large, or when you actually need to protect information — that calls for encryption, which is a different thing entirely.