Base64

Computers store everything as numbers, including images, music, and programs. However, some transmission paths on the internet can only handle plain text, meaning letters, digits, and a few punctuation marks. Base64 solves this problem: it rewrites arbitrary data into a long chain made up of exactly 64 permitted characters. Allowed are the letters A to Z, a to z, the digits 0 to 9, as well as the plus sign and the slash character. An image thus becomes an unreadable but completely harmless block of text. Anyone who knows the rule can restore the original at any time — nothing is lost.

Why text is the safest way to transmit data

Many systems on the internet are old and were designed for plain text only. Email is the best-known example. If you send raw image data through it, the data will randomly contain character sequences that the system might misinterpret as a control command. The file then arrives damaged, or not at all. Base64 avoids this because it only uses characters that mean the same thing everywhere.

A second reason is convenience for developers. Sometimes a small file shouldn’t be loaded separately but instead placed directly inside a text file. A tiny icon can be written as Base64 text right in the middle of a webpage’s code. The browser then doesn’t need a second loading step, which makes the page marginally faster.

There is an important distinction that is often misunderstood. Base64 is not encryption and not password protection. There is no secret, no key, nothing hidden. Anyone can convert a Base64 string back in seconds. Anyone who “secures” confidential data this way is not protecting anything at all.

Three bytes become four characters

Data consists of bytes, and each byte consists of eight bits, meaning eight zeros or ones. Base64 always takes three bytes at a time, which is 24 bits. It doesn’t split these 24 bits into groups of three, but into groups of six. This produces four blocks of six bits each.

With six bits, 64 different values can be represented, from 0 to 63. This is exactly why the method is called Base64. For each of these 64 values, there is a character in a fixed table. The value 0 becomes A, the value 25 becomes Z, the value 26 becomes lowercase a, and so on. So three bytes of source data become four text characters.

This comes at a price: the text is about one third longer than the original. An image of 300 kilobytes takes up about 400 kilobytes as Base64. If the file doesn’t divide evenly by three, one or two bytes are missing at the end. In that case, the method appends one or two equals signs. These trailing padding characters are the most distinctive giveaway of Base64.

Where this character jumble shows up

Every email attachment you send is converted to Base64 along the way. You don’t notice this because the program automatically handles the conversion back. It only becomes visible when you look at the source code of an email. There, you’ll find pages of seemingly meaningless letter jumble — that’s the attached photo.

Base64 is also ubiquitous in web development. Small graphics appear as so-called data URLs directly in the page code, recognizable by the beginning “data:image/png;base64,”. Many interfaces between programs work the same way. When an AI application sends an image to a server, the image often travels along as Base64 text.

In news about IT security, the term appears with a negative connotation. Attackers like to hide malicious code in Base64 so that simple filters don’t recognize it as program code. This isn’t a real hiding place, just a thin layer of disguise. Modern protection systems routinely decode such strings and check what’s actually inside them.