SwitchPDF
All articles
Developer August 16, 2026 4 min read

Base64 Explained: When to Use It and When Not To

Base64 is not encryption and it makes your data bigger. Here is what it is actually for.

Base64 turns binary data into text using 64 safe characters. That's the whole idea. Two things follow from it that people get wrong constantly.

It is not encryption

Base64 is trivially reversible by anyone, with no key. cGFzc3dvcmQxMjM= is not a hidden password, it's the word password123 in a light disguise. Anything sensitive that's "protected" by Base64 is not protected.

The confusion is understandable — it looks scrambled. It isn't. Treat it as no more private than plain text.

It makes data about 33% bigger

Three bytes of input become four characters of output. Encoding a 3 MB image gives you a 4 MB string. That's the price you pay for making binary safe to put in a text channel.

What it is genuinely for

Embedding small assets — a 2 KB icon as a data: URI saves an HTTP request. A 500 KB photo as a data URI is a mistake: it can't be cached separately and it bloats the HTML.

Binary in JSON — JSON has no binary type, so a file attachment in an API payload gets Base64'd.

Email attachments — SMTP is a text protocol. Every attachment you've ever sent was Base64 encoded.

Basic auth headers — Authorization: Basic <base64 of user:pass>. Note this is encoding for transport, not security. It's why Basic auth over plain HTTP is unsafe.

JWT parts — the header and payload of a token are Base64url encoded, which is why decoding a JWT requires no key.

URL-safe Base64

Standard Base64 uses + and /, which have meaning in URLs, and = for padding. The URL-safe variant swaps them for - and _ and usually drops the padding. If a token round-trips fine in a body but breaks as a query parameter, this is why.

Unicode is where it breaks

The browser's built-in btoa() throws on any character above U+00FF. So btoa("café") fails, and btoa("日本語") definitely fails. You have to encode to UTF-8 bytes first. SwitchPDF Base64 handles Unicode and the URL-safe variant correctly in both directions, in your browser.

A quick decision rule

  • Need to hide something? Use encryption, not Base64.
  • Need to make something smaller? Use compression, not Base64 — it does the opposite.
  • Need to put binary somewhere only text is allowed? That's the job.

Bottom line

Base64 solves exactly one problem: binary data in a text-only channel. It is not security and not compression. Used for its actual purpose it's invisible and reliable; used for anything else it's a 33% tax and a false sense of safety.

Related articles