What Is Base64 Encoding?
Base64 is a binary-to-text encoding scheme that converts binary data into a string of ASCII characters using a 64-character alphabet: A–Z, a–z, 0–9, + and /, with = as padding. Every 3 bytes of binary data are encoded as 4 Base64 characters, resulting in approximately 33% size overhead. Base64 is defined in RFC 4648 and is widely used in web development, email systems and security protocols.
Base64 does not encrypt data — it only encodes it. Anyone who receives a Base64 string can decode it back to the original data instantly. It is used purely to safely transmit binary data through channels that only support text, such as HTTP headers, JSON payloads, XML documents and email bodies.
Standard Base64 vs URL-Safe Base64
Standard Base64 uses + and / characters which have special meaning in URLs and file systems. URL-safe Base64 (Base64url, defined in RFC 4648 §5) replaces + with - and / with _, making the output safe for use in URLs, filenames and HTTP query parameters without percent-encoding. URL-safe Base64 is used in JWT tokens (JSON Web Tokens), OAuth tokens, and any web application that passes Base64 data in URLs.
Common Base64 Use Cases in Web Development
- Inline images in HTML/CSS:
src="data:image/png;base64,iVBOR..."— eliminates an HTTP request - HTTP Basic Authentication: Headers use
Authorization: Basic base64(username:password) - JWT tokens: The header and payload sections of JWTs are URL-safe Base64 encoded
- Email attachments: MIME encodes file attachments as Base64 within the email body
- API payloads: Binary files embedded in JSON APIs are Base64 encoded strings
- Environment variables: Binary config files (like SSL certificates) encoded as Base64 for env vars
- WebSockets and binary protocols: Base64 used when binary frames are not supported
How to Decode a Base64 String in Code
Decoding Base64 is natively supported in every major programming language. In JavaScript (browser): atob('SGVsbG8=') returns 'Hello'. In Node.js: Buffer.from('SGVsbG8=', 'base64').toString('utf-8'). In Python: import base64; base64.b64decode('SGVsbG8='). In PHP: base64_decode('SGVsbG8='). In cURL (command line): echo 'SGVsbG8=' | base64 --decode.