The formula
every 3 bytes → 4 characters from an alphabet of 64
Where it comes from
Base64 neither encrypts nor compresses: it writes bytes using 64 printable characters so they survive places that only accept text, such as an email or a URL. It takes bytes three at a time — 24 bits — and splits them into four groups of six, and each six-bit group becomes one character. That is why the result always grows by a third, and why data that does not fill the last three bytes is padded with equals signs.
How to work it out by hand
- Turn the text into UTF-8 bytes: an accented letter is two, an emoji four
- Group the bytes in threes
- Split each 24-bit group into four six-bit pieces
- Replace each piece with its character from the alphabet
- If the last group is short, pad with =
What is worth knowing
The classic trap is calling the browser’s btoa and atob directly: they work on one-byte-per-character strings and break on the first accent or emoji, which is exactly what someone pastes. Here the text goes through UTF-8 first. The URL-safe variant swaps plus for hyphen and slash for underscore, and usually drops the padding, because those three characters mean something inside a web address or a JWT. And a warning worth repeating: Base64 is readable at a glance. A password in Base64 is still a plain-text password with a different look.