What Base64 actually does
Base64 is an encoding scheme: it takes binary data and represents it using only 64 printable ASCII characters (A-Z, a-z, 0-9, plus + and /). It exists because plenty of systems, older email protocols especially, were only ever designed to reliably carry plain text, not raw binary. Base64 is the workaround, repackage the binary as text first, decode it back to binary on the other end.
Binary Data
raw bytes
Split Into 6-bit Groups
Map Each Group to the 64-Character Alphabet
Base64 Text
Why it's about 33% bigger
Every 3 bytes of input becomes 4 Base64 characters, a 4-to-3 ratio that works out to roughly 33% larger than the original. That's a fixed, unavoidable cost of the encoding itself, not a bug or a bad implementation. If the input isn't a clean multiple of 3 bytes, = padding characters get added at the end to keep the output length consistent.
Why it's not encryption
This is the actual misconception worth clearing up: Base64 output looks like gibberish at a glance, which makes it easy to mistake for something secure. It isn't. The alphabet and the encoding rule are both fully public and standardized, decoding it back to the original data requires no secret, no key, nothing, any standard library (or a lookup table, by hand) reverses it instantly.
- Requires a secret key to reverse
- Provides real confidentiality
- Designed specifically to hide data from anyone without the key
- No secret needed, reversible by absolutely anyone
- Provides zero confidentiality
- Designed to make binary data safely transportable as text
Where Base64 genuinely helps
Embedding an image directly inside HTML or CSS as a data URI (data:image/png;base64,...), so the browser doesn't need a separate image request at all. Encoding binary attachments inside an email's MIME structure, which is genuinely where Base64 originated. Passing binary data through JSON, which only supports text values, no raw binary field type exists. HTTP Basic Authentication headers also use it (Authorization: Basic base64(username:password)), which is exactly why Basic Auth is only actually safe over HTTPS, the encoding itself hides nothing.
A real gotcha: standard Base64 isn't URL-safe
The standard alphabet's + and / characters both have their own special meaning inside a URL, dropping raw Base64 output directly into one can break it. A URL-safe variant exists specifically for this, swapping + for - and / for _, sometimes called Base64URL. If you're embedding encoded data in a link or a query parameter, that's the version to reach for, not the standard one.