Lumarc Studio

Developer Guide · September 8, 2026

Base64 Encoding Explained — When and Why to Use It

A clear explanation of Base64 encoding, how it works, when to use it and common use cases including data URLs, API authentication and email attachments.

Base64 encoding converts binary data into a text-safe format using 64 printable ASCII characters. It is one of the most common encoding schemes in web development, yet many developers use it without fully understanding what it does, when it helps and when it introduces unnecessary overhead.

This guide explains how Base64 works, covers practical use cases and clarifies common misconceptions.

What Base64 encoding does

Base64 takes binary data — any sequence of bytes — and represents it using only letters (A–Z, a–z), digits (0–9) and two additional characters (+ and /, with = for padding). This produces output that is safe to transmit through systems that only handle text, such as email protocols, JSON payloads and URL parameters.

The encoding process works by:

  1. Taking the input as a stream of bytes
  2. Grouping every 3 bytes (24 bits) together
  3. Splitting each group into 4 chunks of 6 bits each
  4. Mapping each 6-bit value to one of the 64 characters in the Base64 alphabet
  5. Adding = padding if the input length is not divisible by 3

The result is always approximately 33% larger than the original data. Three bytes of input produce four bytes of Base64 output.

Common use cases

Data URLs in web development

Data URLs embed file content directly in HTML or CSS using Base64 encoding. This eliminates an additional HTTP request for small assets:

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAB..." />

Data URLs are practical for small images (icons, simple graphics under 1–2 KB) where the overhead of an additional HTTP request outweighs the size increase from Base64 encoding. For larger images, a regular URL with proper caching is more efficient.

API authentication

HTTP Basic Authentication encodes credentials in Base64:

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

This is encoding, not encryption. The Base64 string above decodes to username:password. Basic Authentication must always be used over HTTPS to prevent credentials from being intercepted in transit.

JSON web tokens (JWT)

JWTs use Base64URL encoding (a URL-safe variant) for the header and payload segments. When you decode a JWT, you are Base64-decoding the first two parts to read the JSON claims inside.

Email attachments

The MIME standard uses Base64 to encode binary attachments (images, PDFs, documents) for transmission through email protocols that only handle 7-bit ASCII text.

Embedding binary data in JSON

JSON cannot represent raw binary data. When an API needs to include binary content (such as a file, image or cryptographic signature) in a JSON response, Base64 encoding is the standard approach:

{
  "fileName": "report.pdf",
  "content": "JVBERi0xLjQKMSAwIG9iago8PA..."
}

Base64 vs Base64URL

Standard Base64 uses + and / as the 63rd and 64th characters, with = for padding. These characters have special meaning in URLs and file paths, which can cause problems in certain contexts.

Base64URL replaces + with - and / with _, and typically omits padding. This variant is safe for use in URLs, query parameters, file names and JWT tokens.

When working with Base64, always check which variant you need:

  • Standard Base64 for data URLs, email encoding and general binary-to-text conversion
  • Base64URL for URLs, query strings, JWT tokens and file system paths

Common misconceptions

Base64 is not encryption

Base64 encoding is fully reversible with no key or secret. Anyone who sees a Base64 string can decode it instantly. Never use Base64 to “hide” sensitive data — it provides zero security.

Base64 is not compression

Base64 makes data larger, not smaller. The output is always approximately 33% bigger than the input. If you need to reduce data size, use compression (gzip, brotli) before or instead of Base64 encoding.

Base64 is not necessary for JSON strings

Regular text strings do not need Base64 encoding to be included in JSON. Only binary data (images, files, raw bytes) benefits from Base64 encoding in JSON contexts.

When not to use Base64

  • Large files: Base64 increases file size by 33%. Embedding a 1 MB image as a Base64 data URL produces 1.33 MB of text, which cannot be cached independently by the browser.
  • Data that is already text: Encoding a JSON string in Base64 just to embed it in another JSON document is unnecessary overhead.
  • Security purposes: Base64 is not a security measure. Use proper encryption (AES, RSA) for sensitive data.

Working with Base64 in practice

In JavaScript, the btoa() and atob() functions handle Base64 encoding and decoding for ASCII strings. For UTF-8 text and binary data, the TextEncoder API provides proper byte handling:

// Encode UTF-8 text to Base64
const encoded = btoa(String.fromCharCode(...new TextEncoder().encode("Hello")));

// Decode Base64 back to text
const decoded = new TextDecoder().decode(
  Uint8Array.from(atob(encoded), (c) => c.charCodeAt(0))
);

For a faster workflow, you can use the Base64 Encoder and Base64 Decoder at Lumarc DevTools. Both tools support standard Base64, Base64URL and data URL output formats, and process everything locally in your browser.

Summary

Base64 encoding is a simple, well-defined tool for converting binary data to text. Use it when you need to transmit binary data through text-only channels. Avoid it when you need security, compression or when the data is already text. Understanding these boundaries helps you make better decisions about data handling in your applications.