Blog
3 min read

What Is Base64? Encoding Explained (and Why It Isn't Encryption)

Base64 turns any data — images, files, binary keys — into plain text made of 64 safe characters, so it can travel through systems that only handle text. How it works, where you'll see it (data URLs, JWTs, API keys, email), how to encode and decode it, and why it provides zero security.

Base64 is a way of turning any data — an image, a PDF, a binary encryption key — into ordinary text made from just 64 characters: A–Z, a–z, 0–9, + and / (with = for padding).

It exists because lots of systems were built to carry text, not raw bytes. Email, JSON, URLs, HTML attributes and environment variables can all choke on binary data. Base64 makes binary data safe to pass through them.

What it looks like

Hello  →  SGVsbG8=

A tiny PNG image as base64 looks like a long block of random letters starting with iVBORw0KGgo....

How it works (simply)

Computers store data in bytes of 8 bits. Base64 takes the data 3 bytes (24 bits) at a time and splits it into four 6-bit chunks. Each 6-bit chunk is a number from 0 to 63, which maps to one of the 64 characters. If the data doesn't divide evenly by 3, = signs pad the end.

The cost: base64 output is about 33% bigger than the original.

Where you'll see it

  • Data URLs: embedding an image directly in HTML or CSS — src="data:image/png;base64,iVBORw0...".
  • Signed JWTs: the header and payload are base64url-encoded JSON; the third part is a base64url-encoded binary signature. You can decode the first two to read their contents.
  • HTTP Basic auth: the Authorization: Basic ... header is username:password in base64.
  • Email attachments, which travel as base64 text inside the message.
  • Keys and certificates in PEM files (-----BEGIN CERTIFICATE----- followed by base64).
  • Secrets in config: Kubernetes Secrets and some environment variables store binary values as base64.

Base64 is not encryption

This is the important bit. Anyone can decode base64 instantly — no key, no password:

echo 'SGVsbG8=' | base64 --decode
# Hello

So:

  • Base64-encoding a password or API key hides nothing.
  • A JWT's contents are readable by anyone who has the token; don't put secrets in it.
  • Kubernetes Secrets are base64, which is why they need encryption at rest separately.

Encoding is for compatibility; encryption is for secrecy; hashing is for verification. (Hashing vs Encryption vs Encoding)

Encoding and decoding

In the terminal (Mac and Linux):

echo -n 'Hello' | base64          # SGVsbG8=
echo 'SGVsbG8=' | base64 --decode # Hello

In JavaScript:

btoa('Hello')        // 'SGVsbG8=' (browser; ASCII text only)
atob('SGVsbG8=')     // 'Hello'
Buffer.from('Hello').toString('base64') // Node.js, handles any bytes

In Python:

import base64
base64.b64encode(b'Hello')  # b'SGVsbG8='

Base64 vs base64url

Standard base64 uses + and /, which mean something in URLs. Base64url swaps them for - and _ and usually drops the = padding, so the result is safe in URLs and filenames. JWTs use base64url.

The summary

  • Base64 turns any data into safe text using 64 characters.
  • It makes data about a third bigger.
  • It is not security — anyone can decode it.

EasySpawn keeps your real secrets out of the browser on a server-side backend, with Claude Code on hand to explain what any encoded blob in your code actually contains. See how it works or join the waitlist.

Related: What Is UTF-8? · What Is JSON? · Environment Variables Explained · Generate a Secret Key

Keep reading