Guide · 5 min read
What is Base64 encoding?
Base64 turns arbitrary bytes into a string made only of letters, digits and a couple of punctuation characters. It exists because many systems — email headers, URLs, JSON fields, HTML attributes — were designed for text and mangle raw binary. Base64 is a safe-transport wrapper, not a security measure.
How the encoding works
Base64 reads the input three bytes at a time. Three bytes are 24 bits, which split evenly into four groups of six bits. Each six-bit group has 64 possible values, and each value maps to one character from the alphabet A-Z, a-z, 0-9, plus and slash.
When the input length is not a multiple of three, the final group is padded with one or two equals signs. That is why so many Base64 strings end in = or ==.
Why output is about a third larger
Every three bytes of input become four characters of output, so encoded data is roughly 133% of the original size, before any line breaks are added. That overhead is the price of surviving a text-only channel and is worth budgeting for when you inline images as data URLs.
Standard versus URL-safe alphabets
The plus and slash characters have special meaning inside URLs, so the URL-safe variant replaces them with hyphen and underscore, and usually drops the padding. If a token fails to decode, an alphabet mismatch is the first thing to check.
Base64 is not encryption
Anyone can decode Base64 instantly, with no key. Never use it to hide credentials or personal data. If you need confidentiality, encrypt the data; if you need integrity, use a hash or a signature. Base64 only answers the question 'how do I move these bytes through a text channel intact?'
Unicode and the classic mistake
The browser's built-in btoa function only accepts characters in the Latin-1 range, so emoji and non-Latin scripts throw an error. The correct approach is to convert the string to UTF-8 bytes first and encode those bytes, which is what our encoder does automatically.