What Is Base64 Used For? Data URIs, Auth, JWT, Email
Base64 turns bytes into plain text so they can travel where only text is allowed. Here are the five places developers meet it most, with real examples, and the cases where it is the wrong tool.
What is Base64 used for? It turns any bytes into a short alphabet of letters, digits, +, / and =, so binary data can travel through systems that only handle text. The Base64 Encode tool does the conversion in the browser, and its page explains how the encoding works and why it is not encryption.
This guide shows where you actually meet Base64 as a developer, with an example of each, and when it is the wrong choice.
Base64 in data URIs
A data URI embeds a small file directly in HTML or CSS, saving a separate request:
<img alt="" src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4IiBoZWlnaHQ9IjgiPjxjaXJjbGUgY3g9IjQiIGN5PSI0IiByPSI0Ii8+PC9zdmc+">That 96-byte SVG became 128 characters, a third larger, which is the cost of Base64 everywhere. It pays off for tiny icons. For anything bigger, a normal file is better: it can be cached on its own, while an embedded copy is downloaded again with every page or stylesheet that contains it.
Base64 in HTTP Basic authentication
"Basic " + Buffer.from("ana:s3cret").toString("base64");
// "Basic YW5hOnMzY3JldA=="The Authorization header carries the user name and password joined by a colon and Base64-encoded. Anyone who sees the header can decode it in one step, so Basic authentication is only acceptable over HTTPS.
Base64url in JWTs
Each of the three parts of a JSON Web Token is Base64url-encoded: the URL-safe alphabet, with - and _ instead of + and /, and no padding. The first part of most tokens decodes to the same header:
Buffer.from("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9", "base64url").toString();
// '{"alg":"HS256","typ":"JWT"}'That is why the JWT Decoder can show a token's contents without any key: the encoding hides nothing.
Base64 in email attachments and JSON
- Email attachments. Email was designed for text, so MIME encodes attachments in Base64, split into lines of at most 76 characters. That is why a 10 MB attachment makes a noticeably larger email.
- Binary data in JSON. JSON has no binary type, so APIs that accept an image or a PDF inside a JSON body usually expect a Base64 string field. It works for small files. For large ones, a separate upload, such as a multipart request or a pre-signed URL, avoids the extra third and the memory needed to hold the whole string.
When not to use Base64
- To hide anything. Base64 is an encoding, reversible by anyone. Storing an API key or a password in Base64 is the same as storing it in plain text.
- For large files over APIs. The size grows by a third and the whole file usually has to fit in memory as one string, on both sides.
- In URLs with the standard alphabet.
+,/and=have meanings in URLs. Use the Base64url alphabet for tokens and IDs that appear in links.
Related tools
Decode Base64 back to readable text, including URL-safe input.
Percent-encode text for safe use in URLs and query strings.
Compute SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or files.
Decode a JWT to inspect its header, payload, and claims instantly.
Related guides
Decoding Base64 is one call in every language, and each call has a trap: atob garbles accents, Buffer accepts junk, and Python rejects missing padding. Here is the correct version of each.
The same character can be fine in one part of a URL and break another. Here is a reference table of what each JavaScript and Python function does with the characters that matter.
A published SHA-256 checksum only helps if you compare it. Here are the exact commands for each operating system, a one-step check against a checksum file, and code for Node.js and Python.
Decoding a JWT shows its claims; verifying it proves they are genuine. Here are the checks a correct verification makes, written out in Node.js and Python so you can see each step.