What Base64 actually does
Base64 is not encryption and not compression — it's a way to represent binary data (images, files, bytes) using only 64 safe text characters (A–Z, a–z, 0–9, + and /). The point is to move binary data through channels that were designed for text, like email, JSON, or a URL, without it getting corrupted.
Why it exists
Many older protocols only reliably handle plain text. If you drop raw binary into them, certain bytes get mangled. Base64 sidesteps this by re-encoding every 3 bytes of data into 4 text characters — which is also why Base64 output is about 33% larger than the original.
Where you'll see it
- Data URIs: small images embedded directly in HTML/CSS as
data:image/png;base64,... - JSON payloads: sending a file inside an API request that only accepts text.
- Email attachments: MIME uses Base64 under the hood.
- Basic auth headers: credentials are Base64-encoded (note: encoded, not secured).
The security misunderstanding
Because Base64 looks scrambled, people sometimes treat it as a way to hide data. It isn't. Anyone can decode it instantly. Never use Base64 to protect passwords or secrets — that's what encryption is for.
Frequently Asked Questions
Is Base64 encryption?
No. It's an encoding, not encryption. Base64 is fully reversible by anyone with no key, so it provides zero security.
Why is Base64 larger than the original?
Because it maps every 3 bytes to 4 text characters, output is roughly 33% bigger than the input. That's the trade-off for text safety.
When should I NOT use Base64?
Avoid it for large files inside JSON or data URIs — the size overhead and lost caching usually make a normal file URL better.