Base64 encoding in short
Base64 turns bytes into text that passes through any system that only handles printable ASCII: e-mail bodies, JSON strings, HTML attributes, HTTP headers. Every 3 bytes become 4 characters, so the encoded text is about 33 percent longer than the input. If the input length is not a multiple of three, one or two = pad the result to a multiple of four characters.
Examples
HellobecomesSGVsbG8=.user:passbecomesdXNlcjpwYXNz– the form HTTP Basic authentication sends asAuthorization: Basic dXNlcjpwYXNz.<<???>>becomesPDw/Pz8+Pg==in the standard alphabet andPDw_Pz8-PgURL-safe without padding.
Standard or URL-safe?
The standard alphabet uses + and /, which have a meaning of their own in URLs and file names. Base64url replaces them with - and _ and usually leaves out the padding. Use it for values in URLs, for file names and for JSON Web Tokens; use the standard alphabet for MIME, data URIs and most APIs.
Encoding is not encryption
Anyone can decode base64; it hides nothing. To read an encoded value, use the base64 decoder. If you need random keys rather than your own text, the base64 generator creates them from secure random bytes.