Lots of systems — email, JSON, URLs, HTTP headers — were designed to carry text, not arbitrary binary data. Base64 exists to bridge that gap: it re-represents any sequence of bytes as plain, printable text that those text-only systems can carry safely.
How the Base64 alphabet works
Base64 uses a 64-character alphabet (A–Z, a–z, 0–9, plus two more symbols) where each character represents exactly 6 bits. Since 3 bytes = 24 bits = exactly four 6-bit groups, Base64 processes input 3 bytes at a time and emits 4 characters per group. When the input isn't a multiple of 3 bytes, one or two = padding characters fill out the final group so the output length always stays a multiple of 4.
This is also why Base64 output is always about 33% larger than the original binary — 3 bytes become 4 characters, an overhead you should account for whenever you consider Base64-encoding large files.
Standard vs. URL-safe Base64
The standard alphabet's last two characters are + and / — both of which have reserved meaning inside a URL. URL-safe Base64 swaps them for - and _ so the encoded text can be dropped directly into a URL path, query string, or filename without additional percent-encoding. JWTs specifically use URL-safe Base64 (without padding) for exactly this reason.
Where Base64 actually shows up
- Data URIs — embedding a small image directly in HTML/CSS with
data:image/png;base64,..., avoiding an extra network request. - Email attachments (MIME) — email was originally a 7-bit text protocol, so binary attachments are Base64-encoded to travel safely.
- HTTP Basic Auth — the
Authorization: Basic ...header is justusername:passwordBase64-encoded (not encrypted — this only works safely over HTTPS). - JWTs — the header and payload segments of a JSON Web Token are URL-safe Base64-encoded JSON.
- Embedding small binary blobs (thumbnails, keys, tokens) inside a JSON payload.
Base64 is not encryption
This is the single most common misunderstanding about Base64: it provides zero confidentiality. There's no key involved — anyone can decode a Base64 string instantly, by hand if necessary. If you need to protect data, encrypt it first and Base64-encode the ciphertext afterward if it still needs to travel as text; never rely on Base64 alone to hide sensitive information.