How Base64 Encoding Works
Base64 converts binary data into a set of 64 printable ASCII characters. The name comes from the number of characters in the encoding alphabet: 26 uppercase letters (A–Z), 26 lowercase letters (a–z), 10 digits (0–9), and two symbols (+ and /), totaling 64. A 65th character, the equals sign (=), is used as padding.
Every 3 bytes (24 bits) of input data are transformed into 4 encoded characters (each representing 6 bits). This is because 2⁶ = 64 — six bits can represent exactly 64 different values, corresponding to the 64-character alphabet. This 3-to-4 byte ratio is why Base64 encoding increases data size by approximately 33%.
Step-by-step: encoding "Man"
Input: M (77), a (97), n (110)
Binary: 01001101 01100001 01101110
Groups: 010011 | 010110 | 000101 | 101110
Decimal: 19 | 22 | 5 | 46
Output: T | W | F | u → TWFu
This process allows data to travel safely through email systems, HTTP requests, APIs, and other text-based protocols without corruption. Systems that were designed for 7-bit ASCII can safely transmit Base64-encoded data that originally contained arbitrary binary values including null bytes and control characters.
Base64 in HTTP Basic Authentication
One of the most common developer encounters with Base64 is in HTTP Basic Authentication. When a server requires Basic Auth, the client encodes the credentials as username:password in Base64 and sends the result in the Authorization header:
// Credentials
admin:password123
// Base64 encoded
YWRtaW46cGFzc3dvcmQxMjM=
// HTTP Header
Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=
Security warning: Basic Auth credentials are only Base64-encoded, not encrypted. Always use HTTPS when transmitting Basic Auth headers to prevent credentials from being intercepted in plaintext.
Base64 URL Encoding vs Standard Base64
Standard Base64 uses + and / as the 62nd and 63rd characters. These characters can require escaping in URLs and form-encoded query values, while / also acts as a path separator. Base64URL replaces them with - and _.
| Variant | 62nd char | 63rd char | Padding | Used In |
|---|---|---|---|---|
| Standard Base64 | + | / | = (required) | Email (MIME), HTTP headers, general data encoding |
| Base64URL | - | _ | = (optional, often omitted) | JWTs, OAuth tokens, URL parameters, filenames |
| Base64 MIME | + | / | =, with line breaks at 76 chars | Email attachments (RFC 2045) |
Base64 Encoding Across Programming Languages
Base64 encoding is natively supported in virtually every programming language. Here are the most common implementations:
// Encode
btoa("Hello World") // → "SGVsbG8gV29ybGQ="
// Decode
atob("SGVsbG8gV29ybGQ=") // → "Hello World"// Encode
import base64
base64.b64encode(b"Hello World") # → b"SGVsbG8gV29ybGQ="
// Decode
base64.b64decode("SGVsbG8gV29ybGQ=") # → b"Hello World"// Encode
Buffer.from("Hello World").toString("base64") // → "SGVsbG8gV29ybGQ="
// Decode
Buffer.from("SGVsbG8gV29ybGQ=", "base64").toString() // → "Hello World"Continue Your Developer Workflow
Inspect complete JSON Web Tokens with expiration and claim details using the JWT Decoder & Debugger, prepare percent-encoded query values with the URL Encoder & Decoder, turn a local image into a Data URI with the Image to Base64 Encoder, or calculate a checksum with the Hash Generator.
Technical References
The standard and URL-safe alphabets are defined in RFC 4648. HTTP Basic Authentication is defined in RFC 7617. Base64 represents bytes as text; neither standard makes the underlying information confidential.