Base64 Encoding Explained: How It Works and When to Use It
Understand the Base64 encoding algorithm, its practical applications in email, data URIs, and APIs, and common pitfalls developers encounter.
What Is Base64 Encoding?
Base64 is a binary-to-text encoding scheme that converts binary data into a sequence of printable ASCII characters. It represents every 3 bytes of input as 4 characters drawn from a 64-character alphabet: A-Z, a-z, 0-9, +, and /. The = character pads the output when the input length is not a multiple of 3.
Unlike encryption, Base64 is not a security measure. It is a reversible transformation designed to safely carry binary data through systems that only handle text.
How the Algorithm Works
The encoding process works in two steps:
- Step 1: Group into 24-bit chunks. The input byte stream is divided into groups of 3 bytes (24 bits). If the last group has fewer than 3 bytes, it is padded with zero bits.
- Step 2: Split into 6-bit indices. Each 24-bit group is split into four 6-bit values. Each 6-bit value (range 0-63) maps to a character in the Base64 alphabet.
For example, the ASCII string "Man" (bytes 77, 97, 110) encodes to "TWFu". The three bytes combine into a single 24-bit number, which is then split into four 6-bit indices: 19, 22, 5, and 46, corresponding to T, W, F, and u.
Common Use Cases
Email Attachments (MIME)
SMTP was designed for text-only messages. When you attach a file to an email, your email client Base64-encodes the binary file so it can traverse text-only mail servers. The MIME standard uses Base64 as its default encoding for non-text content.
Data URIs in HTML and CSS
You can embed small images directly in HTML or CSS using data URIs. The binary image data is Base64-encoded and placed inline, eliminating an extra HTTP request. This is useful for icons and small decorative images under ~2 KB. For larger images, the ~33% size increase makes this approach inefficient.
API Payloads
Many APIs accept binary data (images, documents) within JSON payloads by Base64-encoding the binary content. JWT tokens also use Base64URL encoding (a URL-safe variant that replaces + with - and / with _) for their header and payload sections.
Common Pitfalls
- Encoding is not encryption. Anyone can decode Base64. Never use it to protect sensitive data.
- Size overhead. Base64 increases data size by approximately 33%. A 3 KB file becomes roughly 4 KB when encoded.
- Line breaks in email. MIME mandates line breaks every 76 characters in Base64 output. Stripping these breaks can corrupt the encoded data when it passes through email servers.
- Character set confusion. Standard Base64 uses + and /, which have special meaning in URLs. Use Base64URL encoding (with - and _) for web contexts.
When to Use Base64 (and When Not To)
Use Base64 when you need to embed binary data in a text-based format or protocol. Avoid it for large files where the 33% overhead is wasteful, or when you could simply reference the data by URL. It is a transport tool, not a compression or security tool.