Base64 shows up everywhere: embedded images, email attachments, API payloads, JWT tokens, data URIs. It looks like encryption, but it isn't — it's a packaging format, and understanding what it does (and costs) prevents a whole class of mistakes.

What Base64 actually does

Many systems only handle text safely: JSON, XML, email bodies, URLs, HTML attributes. Raw binary bytes break them. Base64 solves this by re-encoding every 3 bytes of binary data as 4 characters drawn from a safe 64-character alphabet (A–Z, a–z, 0–9, +, /), with = as padding.

Related reading: How to Remain Valuable When Intelligence Becomes Cheap — a 224-page practical book on staying valuable as intelligence gets cheap. $3.84. Read it on Gumroad →

The encoding is fully reversible and completely deterministic — the same input always produces the same output. Anyone can decode it instantly. That is the point: Base64 is about transport, not secrecy.

What it costs

The price is size. Base64 output is roughly 33% larger than the input, and it must be decoded before use, which costs CPU on both ends. For small payloads — tokens, thumbnails, short files — that's negligible. For large media it adds up fast, which is why you embed a small icon as a data URI but serve a photo gallery as files.

When to use it (and when not to)

  • Use it to embed binary data in text-only formats: images in JSON APIs, files in email (MIME), small assets in CSS or HTML, binary blobs in localStorage.
  • Don't use it for security — it provides none. Don't use it to "hide" credentials or tokens; that's obfuscation, and decoders are one click away. And don't Base64-encode already-large files for storage; you're paying a third more space for nothing.

To experiment safely, the Base64 text codec encodes and decodes in your browser, and the image to Base64 converter handles the file-embedding case — handy for checking exactly what that opaque string in an API response actually contains.

The one-line summary

Base64 is an envelope, not a lock: it gets binary data through text-only systems intact, at a 33% size premium, with zero secrecy. Use it for transport, never for protection.