What Base64 encoding is for
Base64 turns arbitrary bytes into plain ASCII text so they can travel through systems that only handle text: email attachments, JSON fields, HTTP headers, data URLs and configuration values. The text is about 33% larger than the original bytes, which is the price of that safety.
It is encoding, not encryption
Base64 is reversible by anyone, with no key. It hides nothing, so never use it to protect a password, a token or personal data. If you need secrecy, encrypt first and then Base64-encode the ciphertext.
Frequently asked questions
Is Base64 encryption?
No. Base64 is a reversible encoding, not a cipher. Anyone can decode it without a key, so it provides no confidentiality. Use it for transport safety, not for protecting secrets.
Why does my Base64 output end with one or two equals signs?
Those are padding characters. Base64 works in blocks of four characters, so when the input length is not a multiple of three the encoder adds = signs to fill the last block. Padding is optional in some contexts and required in others.
What is the difference between +/ and -_ in Base64?
Standard Base64 uses + and /. The URL-safe variant, called Base64URL, replaces them with - and _ so the result can be used inside a URL or a filename without escaping. JWTs use Base64URL.
Does Base64 make my data smaller?
No, it makes it about a third larger. If your goal is size, compress the data first with gzip and then Base64-encode the compressed bytes.