Base64 shows up everywhere email attachments, data URIs, JWTs, Basic Auth headers but it's one of the most misunderstood pieces of everyday encoding.
What Base64 actually does
Base64 takes arbitrary binary data and represents it using only 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It exists because a lot of older systems email protocols especially were only designed to safely transmit plain text, not raw binary.
Three bytes of input become four Base64 characters, which is why Base64-encoded data is roughly 33% larger than the original.
What it is not
- Not encryption. There's no key. Anyone can decode Base64 instantly that's the whole point, it's meant to be reversible by design, not secret.
- Not compression. It makes data larger, never smaller.
- Not a security measure. If you see credentials Base64-encoded (like in an HTTP Basic Auth header), treat that as equivalent to plaintext, because functionally, it is.
When Base64 makes sense
- Embedding a small image directly in CSS or HTML as a data URI, avoiding an extra network request.
- Encoding binary attachments inside JSON payloads, since JSON is text-only.
- Representing the header/payload segments of a JWT.
When it doesn't
- "Hiding" sensitive data. If someone can see the Base64 string, they can decode it in one line of code.
- Reducing file size. Reach for gzip or a real compression algorithm instead.
Try it yourself
Our Base64 Encoder/Decoder runs the conversion entirely in your browser nothing you paste is transmitted anywhere, which matters more than usual here since people often paste tokens and credentials into Base64 tools without thinking about it.