You've probably seen a string of random letters, numbers, and slashes in an email attachment, a JWT token, or a data URL in your browser's developer tools. Chances are it was Base64. It's everywhere in modern computing — but it's frequently misunderstood. This guide explains what Base64 actually is, how it works, and when (and when not) to use it.
The problem Base64 solves
Computers store everything as binary — sequences of 0s and 1s. But many communication systems (email servers, HTTP headers, HTML attributes, XML files) were designed for text only. When you need to transmit binary data (an image, a PDF, arbitrary bytes) through a text-only channel, you need a way to represent those bytes as safe text characters.
Base64 is the most widely used solution to this problem.
The Base64 alphabet
Base64 uses exactly 64 printable ASCII characters to represent binary data:
The 64 characters:
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
a b c d e f g h i j k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 + /
Plus "=" as a padding character (not in the alphabet itself)
Each of these 64 characters represents exactly 6 bits of binary data (2⁶ = 64). This is the key insight: Base64 converts binary data from 8-bit bytes to 6-bit groups represented as characters.
How the encoding works
Base64 processes input in groups of 3 bytes (24 bits) at a time, converting each group into 4 Base64 characters (24 bits / 6 bits each):
Encoding "Man":
Char:
M
01001101
Char:
a
01100001
Char:
n
01101110
Combined 24 bits: 010011 010110 000101 101110
Base64 values: 19 22 5 46
Output: TWFu
The padding characters (==)
Base64 encodes in blocks of 3 bytes. If your input isn't a multiple of 3, the last block is padded:
- Input length mod 3 = 0 → No padding
- Input length mod 3 = 1 → Two "=" padding characters
- Input length mod 3 = 2 → One "=" padding character
Base64("a") = YQ==
Base64("ab") = YWI=
Base64("abc") = YWJj
Size overhead
Base64 increases data size by approximately 33%. Every 3 bytes of input become 4 Base64 characters. A 100 KB image becomes ~133 KB in Base64. This overhead is why Base64 is avoided when binary transmission is available — but it's acceptable for small embedded data like icons.
URL-safe Base64
Standard Base64 uses + and / — both have special meanings in URLs. URL-safe Base64 replaces them:
Standard Base64
Uses: A-Z a-z 0-9 + / =
Not safe in URLs without percent-encoding (%2B, %2F, %3D)
URL-safe Base64
Uses: A-Z a-z 0-9 - _ (no padding)
Safe in URLs, filenames, HTTP headers. Used in JWTs and OAuth.
Where Base64 is used
Email attachments (MIME)
SMTP was designed for 7-bit ASCII text. MIME encoding converts binary files (PDFs, images) to Base64 for transmission.
Data URLs in HTML/CSS
Embed images directly: <code>data:image/png;base64,iVBOR...</code> — no separate HTTP request needed for small icons.
JSON Web Tokens (JWTs)
JWT headers and payloads are Base64URL-encoded JSON. The signature is also Base64URL-encoded. Note: the content is readable — JWTs are not encrypted by default.
HTTP Basic Authentication
The Authorization header sends username:password as Base64: <code>Authorization: Basic dXNlcjpwYXNz</code>. This is NOT secure without HTTPS.
TLS certificates (PEM format)
PEM files wrap DER binary certificates in Base64, making them copyable as text. The -----BEGIN CERTIFICATE----- header is a telltale sign.
Storing binary in JSON/XML
Databases and APIs that only support text strings use Base64 to encode binary blobs like images, keys, or arbitrary byte arrays.
What Base64 is NOT
⚠️ Base64 is encoding, not encryption
Anyone can decode Base64 in seconds — there is no secret key and no security. Running atob("aGVsbG8=") in any browser console returns "hello". Never use Base64 to hide sensitive data. If you need confidentiality, use proper encryption (AES-256-GCM). If you need to verify integrity, use a hash (SHA-256). Base64 provides neither.
Try it yourself
Our Base64 Encoder/Decoder converts text to and from Base64 (standard and URL-safe) directly in your browser. Nothing is sent to any server.
Frequently asked questions
Is Base64 the same as encryption?
No. Base64 is encoding, not encryption. It's a reversible format change with no secret key. Anyone who sees Base64 data can decode it instantly. For actual security, use encryption (AES-256) or hashing (SHA-256) depending on your needs.
Why does Base64 output often end with ==?
Because Base64 encodes in 3-byte groups. If your input isn't a multiple of 3 bytes, the final group is padded with 1 or 2 '=' characters to complete the 4-character block. You get '==' when 1 byte remains, '=' when 2 bytes remain. URL-safe Base64 strips this padding.
Why is Base64 33% larger than the original?
Because 6 bits of binary data are encoded as 8-bit ASCII characters. Every 3 bytes (24 bits) of input produce 4 characters (32 bits) of output: 32/24 = 1.333... — a 33% overhead.
Can Base64 encode any type of file?
Yes. Base64 is purely a binary-to-text format conversion — it doesn't care what the bytes represent. Images, PDFs, executables, audio files, and arbitrary byte arrays all encode and decode correctly through Base64.