Inside Basic Authentication: How Base64 Encoding Really Works

What is Basic Authentication?

Basic Authentication is a simple HTTP authentication method where the client sends — username + “:” + password in the HTTP header while accessing a resource from the server. But sending this directly is unsafe (plain text), so it is encoded using Base64 before being sent.

For example, the username = “admin” and password = “pass1234”, so instead of sending admin:pass1234, we send “YWRtaW46cGFzczEyMzQ=” in the HTTP header.

GET /users HTTP/1.1
Host: api.example.com
Authorization: Basic YWRtaW46cGFzczEyMzQ=

Now let’s jump in how Base64 encoding works behind the scene.

What is Base64 Encoding?

• Base64 is NOT encryption
• It is just an encoding technique

It converts binary or text data into a limited set of 64 characters:

• A–Z (26)
• a–z (26)
• 0–9 (10)
• + /

Step-by-Step: How Base64 Encoding Works

Let’s encode “admin:pass1234”

Step 1: Convert to ASCII

a = 97
d = 100
m = 109
i = 105
n = 110
: = 58
p = 112
a = 97
s = 115
s = 115
1 = 49
2 = 50
3 = 51
4 = 52

Step 2: Convert ASCII → Binary (8 bits each)

a → 01100001
d → 01100100
m → 01101101
i → 01101001
n → 01101110
: → 00111010
p → 01110000
a → 01100001
s → 01110011
s → 01110011
1 → 00110001
2 → 00110010
3 → 00110011
4 → 00110100

Step 3: Group into 6-bit chunks

Base64 works on 6-bit groups, so we split the continuous binary stream into 6-bit chunks:

011000 010110 010001 101101 011010 011011 101110 001110 100111 000001
011000 010111 001100 110001 001100 100011 001101 00

Step 4: Convert 6-bit → Decimal

Now convert each 6-bit group into numbers:

Get Rifat Arefin’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

24(011000) 22(010110) 17 45 26 27 46 14 39 1 24 23 12 49 12 35 13 0

Step 5: Map to Base64 Table

Base64 map table: Each number maps to a character:

Convert using Base64 index table:

24 → Y
22 → W
17 → R
45 → t
26 → a
27 → b
46 → u
14 → O
39 → l
1 → B
24 → Y
23 → X
12 → M
49 → x
12 → M
35 → j
13 → N
0 → A

Step 6: Add Padding (=)

Why padding (=) is Needed in Base64?

Base64 does not encode data byte-by-byte randomly. Instead, it always works in 3 bytes (24 bits) → becomes 4 Base64 characters. Because it is designed to convert binary data into text using a fixed 6-bit mapping system, and the cleanest way to do that is grouping 24 bits (3 bytes) into 4 chunks of 6 bits.

Problem: What if data is NOT divisible by 3?

Let’s check: “admin:pass1234”

This string has: 14 characters = 14 bytes

Now divide by 3: 14 ÷ 3 = 4 full groups (12 bytes) + 2 leftover bytes

• 12 bytes → encoded normally
• 2 bytes → incomplete block

What happens to leftover bytes?

Base64 cannot process incomplete 3-byte blocks directly. So, it adds extra zero bits internally and uses ‘=’ padding to mark missing bytes

Padding Rules (Very Important)
Remaining bytes Padding Base64 output behavior

• 3 bytes: none
• 2 bytes: = 1 padding character
• 1 byte: == 2 padding characters

In our case: “admin:pass1234”, we had 14 bytes → 12 + 2 leftover bytes. So, we need to pad one “=”.

That’s why final Base64 ends with: “YWRtaW46cGFzczEyMzQ=”

What happens during decoding?

When decoding: “YWRtaW46cGFzczEyMzQ=”

The decoder sees “=” and knows some bits were artificial padding. Then removes them and restores original string exactly — “admin:pass1234”

Now this content is carried through the HTTP header of each request.