What Base64 Actually Does

By Daniel Okafor · September 8, 2026 · Developer Tools

Base64 is not encryption, not compression and not obfuscation. It is a way of carrying binary data through systems that only accept text, and it always costs you a third more bytes.

Base64 turns arbitrary binary data into a string of 64 safe characters. It exists because a great deal of infrastructure, email in particular, was designed for text and mangles or rejects raw bytes. Encoding lets an image or an encrypted blob travel through a text-only channel intact.

The mechanism, briefly

The encoder takes three bytes, which is 24 bits, and re-slices them into four groups of six bits. Each six bit group indexes a table of 64 characters: the letters in both cases, the digits, and two symbols. Four output characters therefore represent three input bytes, which is why encoded data is roughly 33 percent larger than the original. When the input length is not a multiple of three, equals signs pad the final group, which is why encoded strings so often end in one or two of them.

It is not security

This is the misunderstanding worth correcting hardest. Base64 is fully reversible by anyone, with no key and no effort. A password stored Base64 encoded is a password stored in plain text with an extra step. The Base64 in an HTTP basic authentication header is there to make credentials transport-safe, not to protect them; that protection comes entirely from TLS. Likewise, the payload of a JSON Web Token is Base64 encoded, not encrypted, and anyone holding the token can read its contents.

Where it is genuinely useful

• Email attachments, the original use case, where the transport is text only.
• Data URIs that embed a small image or font directly in HTML or CSS, avoiding a network request.
• Carrying binary content inside a JSON field, since JSON has no binary type.
• Encoding cryptographic keys and certificates for storage in text configuration files.
• Passing small binary blobs through systems that would otherwise corrupt them.

Where it costs you

The 33 percent expansion matters at scale. Embedding a large image as a data URI inflates the HTML, prevents the browser caching the image separately, and blocks rendering until the whole document arrives. The rule of thumb is that inlining is worth it only for assets of a few kilobytes. Base64 also defeats compression somewhat and makes payloads unreadable to humans debugging a request.

Practical notes

1. Use URL-safe Base64, which substitutes two characters, whenever the value goes into a URL or filename.
2. Be careful with line breaks: some encoders wrap output at a fixed width and some decoders reject the wrapping.
3. Remember that decoding text requires knowing the original character encoding to render it correctly.
4. Never paste sensitive production data into an online encoder you do not control.
5. Check padding if a decoder complains, since truncated strings are a common copy and paste casualty.

Wrapping up

Base64 is a transport convenience with a predictable size penalty and no security value. Use it to move binary through text channels, and use encryption when you need secrecy.

Encode or decode Base64 instantly in your browser.

Try the Base64 Encoder / Decoder tool.

SwiftMultiTool — free online tools for everyone. Home · Blog · About · FAQ · Contact