What Is Base64 Encoding?
Base64 is a way of representing binary data — images, files, or any raw bytes — using only 64 plain text characters: A–Z, a–z, 0–9, plus + and /. It is not encryption and provides no security. Its single purpose is to let binary data travel safely through systems that were built to handle text, such as email, JSON, HTML, and URLs.
You can convert text and data instantly with our free Base64 Encoder & Decoder.
Why Base64 Exists
Many older internet protocols were designed for 7-bit text. When you try to push raw binary bytes through them, certain byte values get corrupted, stripped, or misinterpreted as control characters. Base64 solves this by translating every 3 bytes of binary into 4 safe text characters. The data gets about 33% larger, but it survives the trip intact.
How Base64 Works (Step by Step)
The algorithm is elegant once you see it:
- Take the input and read it as a stream of 8-bit bytes.
- Group the bits into chunks of 6 bits instead of 8.
- Each 6-bit chunk has a value from 0–63, which maps to one character in the Base64 alphabet.
- If the input length is not divisible by 3, the output is padded with
=signs.
For example, the word "Hi" becomes "SGk=". The trailing = tells the decoder that padding was added.
Where You See Base64 Every Day
| Context | How Base64 is used |
|---|---|
| Email attachments | The MIME standard encodes files as Base64 inside the message body |
| Data URIs in CSS/HTML | Small images embedded directly: data:image/png;base64,... |
| JSON Web Tokens (JWT) | Header and payload are Base64URL-encoded |
| API keys & auth | HTTP Basic Auth encodes "user:password" in Base64 |
| Storing binary in databases | Lets text-only columns hold file data |
Base64 Is Not Encryption — A Vital Warning
This is the single most important thing to understand. Anyone can decode Base64 in one second — including with the tool on this site. It hides nothing. Never use Base64 to "protect" passwords, tokens, or private data. If you see credentials stored as Base64 and assume they are secure, you have a serious vulnerability. For real protection you need encryption (AES, RSA) or hashing (bcrypt, Argon2), which are entirely different concepts.
Base64 vs Base64URL
Standard Base64 uses + and /, which have special meaning inside URLs. The Base64URL variant replaces them with - and _ and often drops the padding, so the result is safe to drop straight into a web address or a JWT. If your decoded data looks corrupted, a mismatch between these two variants is the usual culprit.
How to Encode and Decode Quickly
Paste your text into the Base64 tool and choose Encode to convert plain text into Base64, or Decode to reverse it. Processing runs locally in your browser, but avoid pasting real secrets on a shared or untrusted device.
The Bottom Line
Base64 is a transport format, not a security tool. It exists to move binary data safely through text-only channels, it makes data about a third larger, and it is fully reversible by anyone. Use it for embedding, transmission, and compatibility — never for secrecy.
Technical reference
RFC 4648 defines the Base64 alphabets, padding rules, and canonical representation. Consult it when interoperability between systems matters.