Why Base64 Exists
Many protocols and formats — email (SMTP), HTTP headers, JSON, and XML — were designed for text. Embedding raw binary data (an image, a certificate, a PDF) directly in a text medium causes problems: certain byte sequences conflict with control characters or special syntax.
Base64 solves this by converting every 3 bytes of binary data into 4 printable ASCII characters. The output contains only letters (A–Z, a–z), digits (0–9), and two special characters (+ and /).
How It Works
Base64 works by taking 3 bytes (24 bits) at a time and splitting them into four 6-bit groups. Each 6-bit group maps to one character in the Base64 alphabet (64 characters = 6 bits).
If the total input length is not a multiple of 3, padding characters (=) are added to make the output length a multiple of 4. This is why Base64 strings often end with = or ==.
URL-Safe Base64
Standard Base64 uses + and / which have special meaning in URLs. URL-safe Base64 (RFC 4648) replaces + with - (minus) and / with _ (underscore). Padding may be omitted. URL-safe Base64 is used in JWT tokens, OAuth parameters, and any context where the encoded value appears in a URL.
Base64 is Not Encryption
Base64 is an encoding, not a cipher. Anyone can decode a Base64 string without a key. Do not use Base64 to protect sensitive data — use proper encryption (AES, TLS) for that purpose. Base64 is used for transport compatibility, not security.
Common Uses of Base64
Base64 is used to embed images directly in HTML or CSS as data URIs (data:image/png;base64,...), to send binary attachments in email (MIME multipart), to encode API keys and credentials in HTTP Basic Auth headers, to store binary blobs in JSON APIs, and to encode cryptographic keys and certificates in PEM format.