What is Base64 Encoding? A Developer's Guide

If you've ever seen a string like SGVsbG8gV29ybGQ= and wondered what it is, that's Base64. It's everywhere in web development — APIs, authentication, images in CSS, and JWT tokens. This guide explains exactly what Base64 is, how it works, and when to use it.

What is Base64?

Base64 is an encoding scheme that converts binary data into a string of printable ASCII characters. It uses 64 characters: A–Z, a–z, 0–9, +, and / (plus = for padding).

The name "Base64" comes from the fact that it represents data in base 64 — 6 bits per character, compared to binary's 1 bit per character or hexadecimal's 4 bits per character.

How does Base64 encoding work?

Base64 works by taking 3 bytes (24 bits) of input and splitting them into four 6-bit groups. Each 6-bit group maps to one of the 64 printable characters.

Input: "Man"
ASCII bytes: 77 (M), 97 (a), 110 (n)
Binary: 01001101 01100001 01101110
Groups of 6: 010011 010110 000101 101110
Base64: T W F u
Result: "TWFu"

This is why Base64 output is always 4/3 the size of the input — every 3 bytes becomes 4 characters.

What is the = padding for?

Base64 processes input in groups of 3 bytes. If the input isn't a multiple of 3, = padding is added to complete the final group:

• Input length divisible by 3 → no padding
• 1 extra byte → == padding
• 2 extra bytes → = padding

Base64 in JavaScript

// Encode
const encoded = btoa("Hello, World!");
console.log(encoded); // "SGVsbG8sIFdvcmxkIQ=="

// Decode
const decoded = atob("SGVsbG8sIFdvcmxkIQ==");
console.log(decoded); // "Hello, World!"

// For Unicode strings (emojis, non-ASCII)
const encode = (str) => btoa(String.fromCharCode(...new TextEncoder().encode(str)));
const decode = (str) => new TextDecoder().decode(Uint8Array.from(atob(str), c => c.charCodeAt(0)));

Base64 in Python

import base64

# Encode
encoded = base64.b64encode(b"Hello, World!")
print(encoded)  # b'SGVsbG8sIFdvcmxkIQ=='

# Decode
decoded = base64.b64decode(b"SGVsbG8sIFdvcmxkIQ==")
print(decoded)  # b'Hello, World!'

# Encode a string
text = "Hello"
encoded = base64.b64encode(text.encode('utf-8')).decode('utf-8')

Common use cases

1. HTTP Basic Authentication

HTTP Basic Auth sends credentials as username:password encoded in Base64:

Authorization: Basic dXNlcjpwYXNzd29yZA==
# Decodes to: user:password

2. Embedding images in CSS/HTML

/* Embed a small icon directly in CSS */
.icon {
  background-image: url('data:image/png;base64,iVBORw0KGgo...');
}

3. JWT tokens

JSON Web Tokens (JWTs) use Base64URL encoding (a variant of Base64) for their header and payload sections.

4. Email attachments (MIME)

Email protocols are text-only. Attachments are Base64-encoded so binary files (PDFs, images) can travel through text-based email systems.

Base64 is NOT encryption

Base64 provides zero security. Anyone can decode a Base64 string in seconds. Never use it to "hide" passwords, API keys, or sensitive data.

It's encoding, not encryption. The only purpose is to safely transmit binary data through text-only channels.