Base64
- Pronunciation
- BAYS-siks-tee-FOR
In short
Base64 is a way to write any binary data, such as an image or a key, using only 64 safe text characters, so it can pass through systems built for text.
What is Base64?
Base64 turns bytes into plain text. It takes the data three bytes at a time, splits those 24 bits into four groups of 6 bits, and writes each group as one of 64 characters: the letters A to Z and a to z, the digits 0 to 9, and + and /. When the data doesn't divide evenly into groups of three bytes, = signs pad the end.
It exists because many systems were built for text and can damage raw bytes: email, JSON, URLs, HTML and HTTP headers. With Base64, an image can travel inside an email or a JSON field, a small file can sit straight in a web page as a data URL, and HTTP Basic authentication carries the user name and password. A variant called base64url uses - and _ instead of + and /, so the result is safe in addresses and file names; JWTs use it.
The price is size: every 3 bytes become 4 characters, so the encoded text is about a third larger than the data. And Base64 is an encoding, not encryption. Anyone can decode it in a moment, so it hides nothing: a password in Base64 is as exposed as one in plain text.
Key takeaways
- Base64 writes any bytes using 64 text characters.
- Every 3 bytes become 4 characters, so the data grows by about a third.
- It carries binary data through email, JSON, URLs and HTTP headers.
- Base64 is an encoding, not encryption: anyone can decode it.
Example
const encoded = btoa("hi!"); // "aGkh"
const decoded = atob(encoded); // "hi!"
// btoa only takes Latin-1 text, so other text goes through its UTF-8 bytes first
const bytes = new TextEncoder().encode("çay");
const safe = btoa(String.fromCharCode(...bytes)); // "w6dheQ=="Readers ask
Is Base64 encryption?
No. Base64 only changes how the bytes are written, and anyone can turn it back without a key. To keep data secret, encrypt it; Base64 is just a way to carry the result as text.
Why does Base64 sometimes end with = or ==?
Base64 works on groups of three bytes. When the last group has only one or two, the output is padded with == or = so its length is a multiple of four. Some formats, such as JWTs, leave the padding out.
See also
- Character EncodingProgramming Fundamentals, p. 8Character encoding is the set of rules that turns text into bytes and back again, so any letter can be stored and sent; today the standard is UTF-8.
- JWTSecurity, p. 19A JWT is a compact, signed token that carries claims like a user ID and expiry time, letting a server verify requests without looking up a session.
- HTTPWeb Development, p. 19HTTP is the protocol that browsers, apps, and servers use to exchange web pages and data through a simple cycle of requests and responses.
- URLWeb Development, p. 52A URL is the address of a resource on the web, made of parts such as a scheme, a host, a path and a query string that tell a browser where and how to fetch it.
- EncryptionSecurity, p. 12Encryption is the process of scrambling data with a key so that only someone holding the correct key can turn it back into its original, readable form.
- HashingSecurity, p. 14Hashing is the process of turning any input into a fixed-length value with a one-way function, used to verify data integrity and store passwords safely.
Sources
Spotted a mistake or something missing on this page?Suggest an edit