Look, I've seen this in professional code reviews more times than I can count: a developer uses Base64 to "hide" a password or an API key in a configuration file, thinking they've added a layer of security. This is a dangerous mistake.

Base64 is not encryption

The biggest misconception I encounter is that Base64 "scrambles" data. It doesn't. It encodes data. Encryption is designed to hide information from anyone without a key; encoding is designed to ensure data survives transport across systems that might struggle with raw binary bytes.

Check this out. If I "encrypt" a secret message using Base64, it looks like this:

import base64

secret = "my-super-secret-password-123"
encoded = base64.b64encode(secret.encode('utf-8'))
print(encoded) 
# Output: b'bXktc3VwZXItc2VjcmV0LXBhc3N3b3JkLTEyMw=='

To a novice, bXktc3VwZXItc2VjcmV0LXBhc3N3b3JkLTEyMw== looks like gibberish. But any developer (or any basic online tool) can reverse that in milliseconds without a key. If you're using Base64 for security, you're essentially locking your front door with a piece of scotch tape. Don't do it.

The "Bytes" requirement and the .encode() dance

Once you realize Base64 is just a way to represent binary data as ASCII text, you'll run into the most common Python error associated with this module: TypeError: a bytes-like object is required, not 'str'.

The base64 module doesn't care about your strings; it cares about bytes. Because Base64 is designed to handle things like images, PDFs, and compiled binaries, it operates exclusively on byte objects. This means you can't just pass a string into b64encode(). You have to encode the string to bytes first, then Base64 encode those bytes.

import base64

# This will fail:
# base64.b64encode("Hello") 

# This is the correct flow:
# String -> Bytes (utf-8) -> Base64 Bytes
data_string = "Learning Python is a journey."
bytes_version = data_string.encode('utf-8')
b64_bytes = base64.b64encode(bytes_version)

# If you want the result back as a readable string (for a JSON API, for example):
b64_string = b64_bytes.decode('utf-8')
print(b64_string) # TGVhcm5pbmcgUHl0aG9uIGlzIGEgans=

It feels like a lot of hopping back and forth between types, but it's intentional. It forces you to be explicit about the character encoding you're using before the binary transformation happens.

Practical application: Embedding binary in text

So, when do I actually use this? The most common scenario I face is when I need to send a small image or a certificate inside a JSON object. JSON is text; you can't put a raw .jpg file inside a JSON string without breaking the parser. That's where Base64 shines.

By converting the image bytes to a Base64 string, you can embed the entire file directly into a text field. The receiving end just reverses the process: b64decode() the string, and you're back to the original binary file. It increases the file size by about 33%, which is the "tax" you pay for the convenience of treating a binary file as a string.

📋 Practical Task

Exercise: Image-to-HTML Data URI Converter

In web development, you can embed images directly into HTML using "Data URIs" instead of linking to an external file. These URIs follow the format: data:image/png;base64,[BASE64_DATA].

Your task is to write a script that takes a local image file and converts it into a full HTML-ready Data URI string.

• Create a small dummy file named test_image.png (you can just write any random bytes to a file using open('test_image.png', 'wb').write(b'\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR...')).
• Read the image file in binary mode.
• Use the base64 module to encode those bytes.
• Convert the resulting Base64 bytes into a UTF-8 string.
• Prepend the required prefix data:image/png;base64, to the string.
• Print the final URI string to the console.