Base64

What it does

Base64 takes arbitrary bytes and represents them using sixty-four characters that survive being pasted into text: the letters, the digits, and two symbols. Three bytes of input become four characters of output, so encoded data is about a third larger than what went in.

The trailing equals signs are padding. They bring the output up to a whole number of four-character groups so a decoder knows where the data ends.

What it is for

Moving binary through something that only accepts text. Email attachments, JSON payloads, data URIs, certificates and API tokens all rely on it.

It is worth being clear that Base64 is not encryption and offers no confidentiality. Anything encoded is trivially readable. It is a transport convenience, though it does turn up constantly in security work precisely because it obscures a payload from casual inspection and from naive filters.

Variants

The URL-safe alphabet swaps the two symbols for a hyphen and underscore, so the result can sit in a URL or filename without being escaped. Padding can be dropped where the length is known by other means; JSON Web Tokens do exactly this.

Decoding here accepts either alphabet, with or without padding, because being strict about that only creates work.

Related

Base32 trades density for characters that survive being read aloud. Hexadecimal is less compact but far easier to read byte by byte.