Base64 shows up almost anywhere a system expects plain text but needs to carry data that isn't naturally text — binary files, raw bytes, or characters a format can't otherwise represent. Here are the situations you're most likely to run into it.
Data URIs (embedding images and fonts directly in HTML/CSS)
A data URI like data:image/png;base64,iVBORw0KG... lets a small image, icon, or font live directly inside an HTML or CSS file instead of as a separate request. Browsers decode the Base64 back into the original bytes and render it as if it were a normal file.
Email attachments (MIME)
Email was designed around plain 7-bit text, so attachments — PDFs, images, documents — are Base64-encoded before being embedded in the message body per the MIME standard. Your email client decodes them automatically when you open or download an attachment.
API authentication and tokens
HTTP Basic Authentication sends "username:password" Base64-encoded in an Authorization header. JWTs (JSON Web Tokens) also use a URL-safe variant of Base64 for their header and payload segments. In both cases, remember: Base64 is not encryption — always send these over HTTPS.
Embedding binary data in JSON or XML
JSON and XML are text formats with no native way to represent raw binary. When an API needs to send a small file, image thumbnail, or cryptographic key inside a JSON response, Base64-encoding it into a string field is a common, simple solution.
Config files and environment variables
Certificates, keys, or other binary secrets are sometimes stored Base64-encoded in environment variables or .env files, since those are line-oriented plain-text formats that can't safely hold raw binary or multi-line content without it.
Encode or decode text instantly, entirely in your browser.
Related: what Base64 actually is