Inputs

Base64 in a nutshell

Base64 encodes binary data using 64 printable characters (A-Z, a-z, 0-9, plus + and /) so it can travel through text-only channels โ€” email headers, JSON, URLs, HTTP headers. Every 3 bytes of input become 4 characters of output, so encoded data is roughly 33% larger than the original.

Standard vs URL-safe

  • Standard uses + and /, padded with = to a multiple of 4. Works for email and most APIs.
  • URL-safe (RFC 4648) swaps +โ†’- and /โ†’_ so the string is safe in URLs and filenames. Padding is usually omitted. Used in JWT, OAuth, and modern web APIs.

Common uses

  • Email attachments (MIME)
  • Embedding small images in CSS/HTML (data: URIs)
  • Encoding binary tokens, API keys, signatures
  • HTTP Basic Auth (username:password is base64-encoded)
Important

Base64 is encoding, not encryption. Anyone can decode it instantly. Don't use base64 to "hide" sensitive data.