Base64 Encode

How Base64 Encoding Works

Base64 solves a very specific problem: moving arbitrary bytes through a channel that only accepts printable text. The trick is to stop thinking in bytes and start thinking in 6 bit chunks. Twenty-four bits divide evenly by both 8 and 6, so the encoder reads the input three bytes at a time (24 bits), slices that block into four groups of 6 bits, and turns each group into one character from a fixed 64 character alphabet.

Because three input bytes always become four output characters, the result is exactly four thirds the original size, an increase of roughly 33 percent before padding and line breaks are counted. That overhead is the price of safe transport, and it is why you should encode only when the destination genuinely cannot carry raw bytes.

1. Read the next three bytes of input, giving 24 bits.
2. Split those 24 bits into four groups of 6 bits each.
3. Read each 6 bit group as a number from 0 to 63.
4. Look up that number in the Base64 alphabet to get one character.
5. Repeat until the input runs out, then apply the padding rules.

Worked Example: Encoding "Man"

The word Man is three ASCII characters, so it forms exactly one complete 24 bit block with nothing left over. That makes it the cleanest possible demonstration.

Result: Man encodes to TWFu, three bytes in, four characters out, no padding needed.

Padding Rules Explained

Real input rarely has a length that is a multiple of three. When the final block is short, the encoder pads the remaining bits with zeros, emits the characters it can, and then appends equals signs so the output length stays a multiple of four. Decoders use that count to work out how many bytes to throw away.

You will never see three equals signs in valid Base64, because a leftover of three bytes is simply a full block. A single stray equals sign in the middle of a string is a reliable sign that two encoded values were concatenated by mistake.

Where Base64 Encoding Is Used

• Data URIs. Small icons and fonts embedded directly in CSS or HTML as data:image/png;base64,... so the browser makes no extra request.
• Email attachments. MIME uses Base64 because SMTP was designed for 7 bit text and would corrupt raw binary.
• JWT segments. The header and payload of every JSON Web Token are Base64URL encoded JSON.
• Binary fields in JSON and XML. Neither format can hold raw bytes, so image blobs and signatures travel as Base64 strings.
• PEM certificates and keys. The text between the BEGIN and END markers is Base64 encoded DER.
• HTTP Basic Authentication. The username and password pair is Base64 encoded, which is exactly why the scheme requires HTTPS.

Base64 Is Encoding, Not Encryption

The related confusion is with hashing. A hash such as SHA-256 is one way and cannot be reversed, while Base64 is fully reversible by design. Choosing the wrong one is one of the most common security mistakes in application code.

The Base64 Alphabet

Every 6 bit group produces a value between 0 and 63, and that value is looked up in the table below. RFC 4648 fixes this ordering: uppercase letters first, then lowercase, then digits, then the plus and slash characters. The padding character (=) is not part of the alphabet, it only marks the end of an incomplete group.