What is Base64 encoding, and when should you use it?

If you've worked with APIs, email, or web development for any length of time, you've run into strings of seemingly-random letters ending in one or two = signs. That's Base64. It's one of the most common encodings on the internet, and also one of the most misunderstood — so let's clear it up.

The problem Base64 solves

A lot of the internet's plumbing was built to carry text, not arbitrary binary data. Email bodies, URLs, JSON, and many config formats expect printable characters. But images, files, and cryptographic keys are raw bytes — and some of those bytes have special meanings or aren't printable at all. Send them through a text-only channel and they get mangled.

Base64 is the fix: it's a way to represent any binary data using only 64 safe, printable characters (A–Z, a–z, 0–9, plus + and /). The result is plain text that survives systems built for text.

How it works (briefly)

Base64 takes your data three bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Each 6-bit group (0–63) maps to one character in the Base64 alphabet. When the data doesn't divide evenly into three, = padding is added at the end — that's why you see those trailing equals signs.

A key consequence: because 3 bytes become 4 characters, Base64 output is about 33% larger than the original. You trade size for safe transport.

Where you'll see Base64

• Data URIs — data:image/png;base64,... embeds an image directly in HTML or CSS.
• HTTP Basic Auth — the username and password are Base64-encoded in the header.
• JWTs — each part of a JSON Web Token is Base64URL-encoded.
• Email attachments — MIME uses Base64 to send files through text-based email.
• API keys, certificates, and tokens that need to travel as text.

The big misconception: Base64 is not encryption

This is the one to remember. Base64 provides zero security. It's not encryption, it's not hashing, it's not obfuscation in any meaningful sense — anyone can decode it instantly with no key. If you need to protect data, use real encryption or a hash; if you just need to move binary data through a text channel, Base64 is the right tool. Confusing the two is a genuine security bug.

Encode and decode Base64 safely

Because Base64 often wraps sensitive things — tokens, credentials, keys — pasting it into a random website means potentially handing that data to a stranger's server. KeepItLocally's Base64 tool encodes and decodes entirely in your browser, so nothing is transmitted. Open DevTools → Network and you'll see it stay silent — and it works offline too.