What Is Base64 Encoding and Why Do Developers Use It Everywhere

You have probably seen strings like this in code, APIs, or data URLs:

SGVsbG8gV29ybGQ=

Enter fullscreen mode

Exit fullscreen mode

That is "Hello World" encoded in Base64. If you have worked with images in CSS, email attachments, API tokens, or JSON payloads, you have already used Base64 — maybe without realising it.

Here is what Base64 actually is, why it exists, and when you should (and should not) use it.

What Is Base64?

Base64 is a way to represent binary data using only text characters. It converts any data — text, images, PDFs, anything — into a string made up of 64 characters: A-Z, a-z, 0-9, +, and /. The = sign is used for padding at the end.

Every 3 bytes of input become 4 characters of output. That is why Base64 encoded data is always about 33% larger than the original.

Why Does Base64 Exist?

Many systems were designed to handle text, not raw binary data. Email (SMTP), JSON, XML, HTML, URLs — they all expect printable text characters.

If you try to embed a raw image file inside a JSON string, it breaks. Binary data contains null bytes, control characters, and values that text systems cannot handle safely.

Base64 solves this by converting binary data into safe, printable text that can be embedded anywhere text is expected.

Where You See Base64 in Practice

Data URLs in HTML and CSS — Instead of linking to an image file, you can embed it directly:

data:image/png;base64,iVBORw0KGgoAAAANSUhEUg...

Enter fullscreen mode

Exit fullscreen mode

Small icons and logos are often inlined this way to save an HTTP request.

Email attachments — Every email attachment you have ever sent was Base64 encoded. SMTP is a text protocol — it cannot transmit raw binary. Your email client encodes attachments before sending and decodes them on the other end.

API authentication tokens — Basic authentication sends credentials as a Base64 string in the Authorization header:

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Enter fullscreen mode

Exit fullscreen mode

That decodes to "username:password". Note: Base64 is encoding, not encryption. Anyone can decode it.

JWTs (JSON Web Tokens) — JWTs are three Base64-encoded segments separated by dots. The payload is not encrypted — it is just Base64 encoded so it can travel safely through URLs and headers.

Storing binary data in JSON or XML — When an API needs to include file content in a JSON response, it Base64 encodes the file. You decode it on the receiving end to get the original file back.

Encode and Decode Base64 Instantly

You do not need to write code every time you need to encode or decode Base64.

Go to ultimatetools.io/tools/coding-tools/base64-encoder-decoder/, paste your text or upload a file, and get the result instantly.

Text mode — Paste any text, click Encode, get the Base64 string. Paste a Base64 string, click Decode, get the original text.

File mode — Upload any file — image, PDF, document — and get its Base64 representation. You can also paste a Base64 string and download the decoded file.

No account. No upload to a server. Everything runs in your browser.

Base64 Is Encoding, Not Encryption

This is the most common misconception. Base64 does not protect your data. It is not a security measure. Anyone can decode a Base64 string in milliseconds.

If you see an API sending credentials or tokens as Base64, those are meant to be read — not hidden. Base64 is for safe transport, not for secrecy.

If you need to protect data, use actual encryption (AES, RSA) or hashing (SHA-256). Base64 is just a formatting tool.

When to Use Base64 (and When Not To)

Use Base64 when:

• You need to embed binary data in a text-only context — JSON, XML, HTML, email, URL parameters

• You need to pass file content through an API that only accepts text payloads

• You are inlining small images or icons to avoid extra HTTP requests (under 10KB is a reasonable threshold)

Do not use Base64 when:

• You want to "hide" or protect data — Base64 is not security

• You are transferring large files — the 33% size increase adds up. A 1MB file becomes 1.33MB in Base64. Use multipart/form-data instead

• You are serving images on a website — linking to an image file is almost always better than inlining a large Base64 string (the browser can cache linked files)

The UTF-8 Problem with btoa and atob

If you have used JavaScript's built-in Base64 functions, you may have hit this error:

Failed to execute btoa — the string contains characters outside of the Latin1 range.

Enter fullscreen mode

Exit fullscreen mode

That happens because btoa only handles single-byte characters. If your text contains emoji, accented characters, or any non-ASCII text, btoa breaks. The fix is to encode the text as UTF-8 first, then Base64 encode the bytes. The tool handles this automatically.

Try It Now

Base64 Encoder/Decoder → ultimatetools.io

No install. No account. Works on any device.

Originally published on Medium. Part of Ultimate Tools — a free, privacy-first browser toolkit with 40+ tools.