Base64 is an encoding: a way to represent any bytes using only 64 safe characters (A to Z, a to z, 0 to 9, plus and slash, with equals signs as padding). Anyone can reverse it instantly, so it hides nothing. If you see credentials "protected" with Base64, they are not protected.
Why it exists
Many systems were built to carry text, not raw bytes: e-mail, JSON, URLs, HTML and XML. Binary data such as an image can contain bytes that break those formats. Base64 converts the bytes into plain text that travels safely and is converted back at the other end.
How it works
Every 3 bytes (24 bits) are split into four groups of 6 bits, and each group picks one of the 64 characters. If the input is not a multiple of 3 bytes, equals signs pad the end. Because 3 bytes become 4 characters, Base64 output is about 33% larger than the original.
Where you see it
- Data URLs that embed small images directly in HTML or CSS.
- E-mail attachments (MIME).
- JSON Web Tokens: the header and payload are Base64URL-encoded JSON, which anyone can read.
- HTTP Basic authentication headers, which is why that scheme needs HTTPS.
- Certificates and keys in PEM files.
When not to use it
- To hide or protect data: use real encryption.
- For large images on a web page: the extra 33% and the lack of caching usually make a normal image file better.