Base64 is not encryption and not compression — it is a way to move binary through text-only channels. Here is how it works, what it costs, and when to reach for it.
Base64 rewrites arbitrary bytes using only 64 characters that survive any text-based transport: A–Z, a–z, 0–9, + and /, with = as padding. It is a transport encoding, not a security measure — anything Base64-encoded can be read back by anyone, instantly.
The input is read three bytes (24 bits) at a time and split into four 6-bit groups. Each group indexes the 64-character alphabet, so every three bytes in become four characters out. When the input length is not divisible by three, the final group is padded with = so decoders know how many real bytes the last block held.
That 3→4 ratio is why Base64 output is roughly 33% larger than the input, before any line breaks are added. A 1 MB image becomes about 1.37 MB of text.
+ and / are meaningful inside URLs and filenames, so RFC 4648 defines a URL-safe alphabet that swaps them for - and _, usually with padding stripped. This is the variant used by JWTs — which is why pasting a JWT segment into a strict Base64 decoder sometimes fails until the characters are translated back.
user:password — encoded, emphatically not encrypted.Because of the 33% size penalty, inlining large assets as data URIs makes pages heavier and defeats separate caching — a 200 KB hero image inlined into HTML is re-downloaded on every page view. Keep data URIs for assets under a few kilobytes.
Base64 also gives a false sense of privacy. If you need secrecy, encrypt first and encode afterwards; a hash is one-way, Base64 is not.
You can paste any string into the Base64 tool to see what it holds; it runs entirely in your browser, so even production secrets never leave the page. If the result looks like binary noise rather than text, inspect the raw bytes with the Hex ↔ Text tool instead.