Base64 is an encoding scheme that represents data using 64 printable ASCII characters (A–Z, a–z, 0–9, + and /). It's used to safely carry data — like an image or a token — through systems that only handle text, such as email, JSON or URLs.
Base64 is not encryption: anyone can decode it. It only makes binary data text-safe.
You can encode or decode Base64 instantly in your browser.
How the encoding works
Base64 takes three bytes at a time — 24 bits — and splits them into four groups of six. Each group indexes into an alphabet of 64 printable characters: A-Z, a-z, 0-9 and two symbols. Four characters therefore carry three bytes, which is exactly why encoded output is about 33% larger than the input. When the data does not divide evenly into three, the encoder pads with one or two equals signs, which is the trailing signature people recognise.
It is not encryption
The most consequential misunderstanding in this area. There is no key and no secret: any decoder reverses it instantly, and a Base64 string is identifiable on sight. API keys, passwords and tokens stored as Base64 in a config file are stored in plain sight. Use it to transport data safely through text-only channels, never to protect it.
Base64url
Standard Base64 uses plus and slash as its last two characters, both of which have structural meaning in URLs and would need escaping. Base64url swaps them for minus and underscore, and usually drops the padding, so the result can be dropped into a URL or a filename unchanged. This is the variant JSON Web Tokens use, which is why a JWT can sit in an HTTP header without any further escaping.
Where you actually meet it
Embedding an image directly in CSS or HTML as a data URI. Attaching a file to a JSON API payload, since JSON has no binary type. Email attachments, which have been Base64 since MIME. HTTP Basic authentication headers, where the username and password are Base64 — and, being merely encoded, are the reason Basic auth is unacceptable over plain HTTP.
When not to use it
For anything large. The 33% overhead is real, and Base64 in a data URI cannot be cached separately from the document containing it, so it is re-downloaded with every page load. It is a good tool for small assets and a bad one for big files, which should be transferred as files.