Key takeaways
- Base64 represents any data using 64 safe text characters so binary can travel through text-only channels such as email, JSON, and URLs.
- Base64 is encoding, not encryption: anyone can reverse it instantly without a key, so a Base64 password is effectively stored in plain text.
- Every 3 bytes become 4 characters, so Base64 output is about a third larger, turning a 300 KB photo into 400 KB of text.
- Data URIs, email attachments, API tokens, and the three dot-separated sections of a JWT are everyday places where Base64 appears.
Base64 is an encoding: a way to represent any data, including binary files like images, using only 64 safe text characters (letters, digits, plus, and slash). It exists because many systems, such as email, JSON, and URLs, were built to carry text and can mangle raw binary bytes. Base64 wraps the binary in text so it travels through those channels untouched.
Where you meet Base64 every day
Data URIs embed small images directly inside HTML or CSS as Base64 text, saving a network request. Email attachments travel as Base64 under the hood. API keys and tokens often arrive Base64 encoded, and JWT tokens are three Base64 sections joined by dots. Anywhere binary needs to ride inside a text field, Base64 is the vehicle. You can see it in action by converting any picture with the Image to Base64 tool, or by encoding plain text with the Base64 Encoder.
The most important fact: Base64 is not encryption
Encoding and encryption answer different questions. Encoding changes how data is written so machines handle it safely, and anyone can reverse it instantly, no key required. Encryption scrambles data so only someone with the key can read it. Base64 is purely the first kind. A password stored in Base64 is, for security purposes, stored in plain text: paste it into any Base64 Decoder and the original appears. If data looks unreadable but decodes in one click, it was never protected, only reformatted.
The 33 percent tax
Base64 represents every 3 bytes of data as 4 text characters, so encoded data is about a third larger than the original. That is why embedding images as data URIs only makes sense for small icons: a 300 KB photo becomes 400 KB of text and bloats the page that carries it. For anything beyond small assets, linking the file normally is lighter than embedding it.
The bottom line
Base64 is a courier, not a safe. Use it to move binary through text channels, expect the one third size increase, and never mistake it for protection. When you actually need secrecy, that is encryption's job.