Base64 Encoding & Decoding: The Complete Developer Guide

What Is Base64?

Base64 is an encoding scheme that represents binary data as a sequence of printable ASCII characters. It was designed to allow arbitrary binary data — images, audio, executables — to pass through channels that only handle text reliably, such as SMTP email, JSON payloads, or HTML data: URIs.

The name "Base64" comes from the 64-character alphabet it uses: A–Z, a–z, 0–9, +, and /, with = as a padding character. Every 3 bytes of binary input are converted into 4 Base64 characters, producing an output that is approximately 33% larger than the original.

How Base64 Encoding Works

The encoding process follows three steps:

Take 3 bytes (24 bits) of input.
Split those 24 bits into four 6-bit groups.
Map each 6-bit group to its corresponding character in the Base64 alphabet.

If the input is not a multiple of 3 bytes, padding (=) is added to bring the output length to a multiple of 4 characters.

Example: Encoding "Man"

M  = 0x4D = 01001101
a  = 0x61 = 01100001
n  = 0x6E = 01101110

Binary: 010011 010110 000101 101110
Base64:  T      W      F      u
Result: TWFu

Base64 in JavaScript

Modern browsers and Node.js (v16+) both have built-in Base64 support:

// Browser & Node.js
const encoded = btoa("Hello, World!");  // "SGVsbG8sIFdvcmxkIQ=="
const decoded = atob("SGVsbG8sIFdvcmxkIQ==");  // "Hello, World!"

// For binary data in Node.js
const buf = Buffer.from("Hello");
const b64 = buf.toString("base64");          // "SGVsbG8="
const back = Buffer.from(b64, "base64").toString();

Important: btoa() only handles Latin-1 (8-bit) characters. For Unicode strings, encode to UTF-8 first:

function toBase64(str) {
  return btoa(unescape(encodeURIComponent(str)));
}
function fromBase64(b64) {
  return decodeURIComponent(escape(atob(b64)));
}

Base64 in Python

import base64

encoded = base64.b64encode(b"Hello, World!")
# b'SGVsbG8sIFdvcmxkIQ=='

decoded = base64.b64decode(b"SGVsbG8sIFdvcmxkIQ==")
# b'Hello, World!'

URL-Safe Base64

Standard Base64 uses + and /, which have special meaning in URLs. URL-safe Base64 replaces them with - and _, and often omits trailing = padding. This variant is used in JWTs, OAuth tokens, and web APIs.

// Node.js
const urlSafe = Buffer.from(data).toString("base64url");

# Python
base64.urlsafe_b64encode(b"Hello")

Common Use Cases

Embedding images in HTML/CSS: <img src="data:image/png;base64,iVBORw0K..."> — eliminates a network request for small images.
JWT tokens: Each section of a JWT (header, payload, signature) is Base64url-encoded.
Basic HTTP Auth: Credentials are sent as Authorization: Basic dXNlcjpwYXNz.
Email attachments: MIME uses Base64 to encode binary attachments in text-based email messages.
Environment variables: Store certificates or keys as Base64 strings in .env files.

Limitations and When Not to Use Base64

Base64 is encoding, not encryption. Anyone can decode it instantly. Never use it to hide sensitive data. Also consider the 33% size overhead — inlining large images as Base64 can hurt page load performance more than the saved HTTP request gains.

Decode & Encode Instantly

Need to encode or decode a Base64 string right now? ToolsVito's Base64 Encoder/Decoder runs entirely in your browser — no data is sent to any server, no sign-up required.