What Is Base64 and When Should You Use It?

Base64 is a way to represent arbitrary bytes using only 64 safe text characters (A–Z, a–z, 0–9, + and /). It exists because many systems — email headers, JSON APIs, data URLs, some config formats — only reliably transport plain text, not raw binary.

The encoding takes every three input bytes (24 bits) and rewrites them as four output characters (each carrying 6 bits from the shared alphabet). That is why Base64 output is roughly 33 percent larger than the input: four characters to carry what three bytes held.

It is encoding, not encryption

Anyone with the string can decode it. Base64 never protects secrets. It only makes binary safe to embed in text channels. Treating Base64 as 'hidden' is a common and dangerous mistake — JWT payloads, for example, are Base64URL and fully readable to anyone who splits the token.

Everyday uses

Common uses include embedding small images directly in HTML or CSS as data URLs (data:image/png;base64,…), transmitting binary attachments inside JSON when multipart is unavailable, and storing small binary blobs in text-only databases.

Email historically used Base64 for attachments (RFC 2045). JWTs use a URL-safe variant that replaces + with − and / with _, and often omits = padding so tokens can sit in URLs and headers without escaping.

URL-safe Base64 and padding

Standard Base64 uses + and /. URL-safe Base64 uses − and _. Both may end with one or two = signs to pad the output to a multiple of four characters. If decoding fails after copy-paste, check for missing padding, stripped + characters, or line breaks introduced by mail clients and PDFs.

When not to use it

Do not use Base64 for passwords (hash them with bcrypt, argon2 or scrypt). Do not use it to 'encrypt' API keys in mobile apps — the key is still in the APK/IPA. Do not use it when a binary-safe channel (multipart upload, raw Buffer, Blob) is available; Base64 only adds size.

Try it locally

Paste any text into the RovoTools Base64 Encoder and decode it back with the Base64 Decoder. Both run entirely in your browser, so even tokens, keys you are debugging, or private strings never leave your device.