How Base64 Encoding Works
Base64 converts binary data into a set of 64 printable ASCII characters. The name comes from the number of characters in the encoding alphabet: 26 uppercase letters (A–Z), 26 lowercase letters (a–z), 10 digits (0–9), and two symbols (+ and /), totaling 64. A 65th character, the equals sign (=), is used as padding.
Every 3 bytes (24 bits) of input data are transformed into 4 encoded characters (each representing 6 bits). This is because 2⁶ = 64 — six bits can represent exactly 64 different values, corresponding to the 64-character alphabet. This 3-to-4 byte ratio is why Base64 encoding increases data size by approximately 33%.
Step-by-step: encoding "Man"
Input: M (77), a (97), n (110)
Binary: 01001101 01100001 01101110
Groups: 010011 | 010110 | 000101 | 101110
Decimal: 19 | 22 | 5 | 46
Output: T | W | F | u → TWFu
This process allows data to travel safely through email systems, HTTP requests, APIs, and other text-based protocols without corruption. Systems that were designed for 7-bit ASCII can safely transmit Base64-encoded data that originally contained arbitrary binary values including null bytes and control characters.
Base64 in HTTP Basic Authentication
One of the most common developer encounters with Base64 is in HTTP Basic Authentication. When a server requires Basic Auth, the client encodes the credentials as username:password in Base64 and sends the result in the Authorization header:
// Credentials
admin:password123
// Base64 encoded
YWRtaW46cGFzc3dvcmQxMjM=
// HTTP Header
Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=
Security warning: Basic Auth credentials are only Base64-encoded, not encrypted. Always use HTTPS when transmitting Basic Auth headers to prevent credentials from being intercepted in plaintext.
Base64 URL Encoding vs Standard Base64
Standard Base64 uses + and / as the 62nd and 63rd characters. These characters have special meaning in URLs — + is a space and / is a path separator. This makes standard Base64 unsafe for use in URLs and filenames.
| Variant | 62nd char | 63rd char | Padding | Used In |
|---|---|---|---|---|
| Standard Base64 | + | / | = (required) | Email (MIME), HTTP headers, general data encoding |
| Base64URL | - | _ | = (optional, often omitted) | JWTs, OAuth tokens, URL parameters, filenames |
| Base64 MIME | + | / | =, with line breaks at 76 chars | Email attachments (RFC 2045) |
Base64 Encoding Across Programming Languages
Base64 encoding is natively supported in virtually every programming language. Here are the most common implementations:
// Encode
btoa("Hello World") // → "SGVsbG8gV29ybGQ="
// Decode
atob("SGVsbG8gV29ybGQ=") // → "Hello World"// Encode
import base64
base64.b64encode(b"Hello World") # → b"SGVsbG8gV29ybGQ="
// Decode
base64.b64decode("SGVsbG8gV29ybGQ=") # → b"Hello World"// Encode
Buffer.from("Hello World").toString("base64") // → "SGVsbG8gV29ybGQ="
// Decode
Buffer.from("SGVsbG8gV29ybGQ=", "base64").toString() // → "Hello World"