What is Base64 encoding, actually?

It shows up everywhere from JWTs to email attachments, but what it's actually doing is simpler than it looks.

Base64 takes binary data — or text — and represents it using only 64 printable characters (A-Z, a-z, 0-9, plus two more like + and /). It exists because a lot of older systems (email, some text-based protocols) were only designed to handle plain text safely, not arbitrary binary bytes. Base64 lets you smuggle binary data through those systems by re-encoding it as text first.

Mechanically, it works by grouping the input into 3-byte chunks (24 bits) and re-splitting those 24 bits into four 6-bit groups. Each 6-bit value (0-63) maps to one of the 64 allowed characters. That's also why Base64 output is roughly 33% larger than the original — you're spending more characters to represent the same information, in exchange for those characters being safe to pass through text-only systems.

A common misconception is that Base64 is a form of security or encryption. It isn't — it's fully and trivially reversible by anyone, with no key involved. A JWT's payload, for instance, is just Base64-encoded JSON: readable by anyone who decodes it, which is why sensitive data shouldn't be put in a JWT payload without separate encryption.

You'll run into it constantly: email attachments (MIME), data URIs for embedding small images in CSS/HTML, HTTP Basic Auth headers, and as noted, JWTs. If you ever need to see what's actually inside one of these, the Base64 encoder/decoder or the JWT decoder will show you the plain text underneath.