What Is Base64?
Base64 is an encoding scheme that converts binary data into a string of ASCII characters. It's not encryption — base64 encoded data is trivially reversible and provides zero security on its own. What it does provide is a way to safely transmit binary data (images, files, bytes) through systems designed to handle only text.
The name comes from the 64 characters used in the encoding: A–Z, a–z, 0–9, plus + and /.
How Base64 Encoding Works
The algorithm takes 3 bytes of binary data (24 bits) and converts them into 4 base64 characters (each representing 6 bits). This means base64-encoded data is always about 33% larger than the original — a necessary trade-off for text compatibility.
The character set:
| Index | Char | Index | Char | Index | Char | Index | Char | |-------|------|-------|------|-------|------|-------|------| | 0 | A | 16 | Q | 32 | g | 48 | w | | 1 | B | 17 | R | 33 | h | 49 | x | | 2 | C | 18 | S | 34 | i | 50 | y | | 3 | D | 19 | T | 35 | j | 51 | z | | 4 | E | 20 | U | 36 | k | 52 | 0 | | 5 | F | 21 | V | 37 | l | 53 | 1 | | 6 | G | 22 | W | 38 | m | 54 | 2 | | 7 | H | 23 | X | 39 | n | 55 | 3 | | 8 | I | 24 | Y | 40 | o | 56 | 4 | | 9 | J | 25 | Z | 41 | p | 57 | 5 | | 10 | K | 26 | a | 42 | q | 58 | 6 | | 11 | L | 27 | b | 43 | r | 59 | 7 | | 12 | M | 28 | c | 44 | s | 60 | 8 | | 13 | N | 29 | d | 45 | t | 61 | 9 | | 14 | O | 30 | e | 46 | u | 62 | + | | 15 | P | 31 | f | 47 | v | 63 | / |
The = padding character appears at the end when the input length isn't divisible by 3.
Real Encode/Decode Examples
| Input Text | Base64 Encoded |
|------------|----------------|
| Hello | SGVsbG8= |
| Hello, World! | SGVsbG8sIFdvcmxkIQ== |
| {"user":"alex"} | eyJ1c2VyIjoiYWxleCJ9 |
| admin:password123 | YWRtaW46cGFzc3dvcmQxMjM= |
| 1 | MQ== |
Notice the = and == padding at the end of several strings — that's the algorithm filling out the last group of bits to complete the 4-character output block.
One thing worth pointing out: YWRtaW46cGFzc3dvcmQxMjM= looks like encrypted data. It's not. Anyone can decode it. HTTP Basic Auth passes credentials in base64, which is why it's only safe over HTTPS — the encoding doesn't protect anything.
Where Developers Actually Use Base64
Data URIs for images: Instead of linking to an image file, you can embed it directly in HTML or CSS as a base64 string: <img src="data:image/png;base64,iVBORw0KGgo...">. Useful for small icons in email templates or single-file HTML documents.
JWT tokens: JSON Web Tokens use base64url encoding (a URL-safe variant) for their header and payload sections. When you decode a JWT and see the claims, that's base64 decoding at work.
Email attachments: The MIME standard uses base64 to encode binary attachments so they can be transmitted through email systems designed for plain text.
HTTP Basic Authentication: As mentioned above, credentials are base64-encoded in the Authorization header: Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=. Decode that and you get admin:password123 immediately. This is why Basic Auth requires HTTPS.
Storing binary data in JSON: JSON doesn't natively support binary data. If you need to include file contents, image bytes, or any binary payload in a JSON field, base64 is the standard approach.
Base64 vs. Base64URL
Standard base64 uses + and /, which have special meaning in URLs and filenames. Base64url swaps them for - and _, making the output safe for URL parameters and filenames without escaping. If you're working with JWTs or URL-embedded data, you want base64url specifically.
Most base64 encode decode tools let you choose between the two variants.
Three Things to Know About Base64
1. It's Not Compression — It Makes Data Larger
Base64 encoding increases data size by roughly 33%. A 100KB image becomes ~133KB when base64 encoded. For small assets embedded in HTML, that's acceptable. For large files, it's not. Don't use base64 to "optimize" file delivery — it does the opposite.
2. Padding Matters in Some Contexts
The = padding at the end of base64 strings is technically required by the spec but often stripped in practice. Some libraries are strict about it; others aren't. If you're getting decode errors on a string that looks correct, check whether the padding is present. Adding missing = characters to reach a multiple-of-4 length usually fixes it.
3. Whitespace Breaks Decoding
Base64 encoded strings should have no line breaks or spaces. Copy-paste from a formatted source (like an email header or a certificate file) often introduces invisible line breaks that cause decode errors. Strip all whitespace before decoding.
Common Base64 Mistakes
A few things trip people up repeatedly. First, double-encoding — running base64 encode on something that's already base64 encoded. You'll get a valid-looking string that decodes to gibberish. If your output looks like U0dWc2JHOD0= when you expected readable text, you've probably encoded twice. Decode once more and you'll get your original.
Second, confusing encoding with encryption. I've seen production codebases where someone base64-encoded a password and stored it thinking it was secure. It's not. Base64 is a transport encoding, full stop. If you need to protect data, use actual encryption (AES, RSA) or hashing (bcrypt for passwords). Base64 just makes bytes safe for text channels.
Third, using base64 for large file storage. Embedding a 5MB image as a base64 string in your database turns it into a 6.7MB text blob that's slower to query, harder to cache, and impossible to serve with standard CDN optimization. Use object storage for files and base64 only for small inline assets.
Try It Yourself
Our Base64 Codec handles both encoding and decoding instantly — paste in text or a base64 string and get the result back in one click. It supports both standard and base64url variants.
Base64 encoding is often used alongside JSON for data transformation and API work — check out our Developer Daily Toolkit for the full set of tools developers use constantly. If you're working with JSON and base64 together (especially for data transmission), our JSON Formatting Guide shows how these tools complement each other. And if you're working with URL encoding (a different but related concept — percent-encoding special characters in URLs), our URL Codec handles that separately.