What is Base64?
Base64 is a binary-to-text encoding scheme that converts binary data into a sequence of printable ASCII characters. It uses a 64-character alphabet — uppercase letters (A–Z), lowercase letters (a–z), digits (0–9), and two additional symbols (+ and /) — to represent every 6 bits of input as one character. This makes it safe to transmit binary data through text-only channels like email, JSON, URLs, and HTML attributes.
The scheme dates to 1987, when Privacy-Enhanced Mail (RFC 989) needed a way to move encrypted binary payloads through email systems that only trusted plain ASCII. The modern specification is RFC 4648, and email attachments still work the same way through MIME, the standard that replaced PEM.
How the Encoding Actually Works
Computers store data in 8-bit bytes, but 64 characters can only name 6 bits each (26 = 64). Base64 resolves that mismatch by regrouping the bits: every 3 bytes of input (24 bits) become 4 six-bit values, and each value picks a character from the alphabet. A 2.4-kilobyte PDF doesn't compress or obfuscate anything — it just gets re-cut into slices the alphabet can spell.
Walk it through with "Hi!": the letters are bytes 72, 105, and 33, or 01001000 01101001 00100001 in binary. Regrouped into sixes — 010010 000110 100100 100001 — those are values 18, 6, 36, and 33, which index into the alphabet as S, G, k, h. So SGkh is "Hi!" in Base64. Decoding runs the same table backward.
When the input isn't a multiple of 3 bytes, the last group comes up short. Base64 pads with = so the output length stays a multiple of 4 — decoders use the padding to know how many real bytes the final group holds:
| Input length mod 3 | Padding added | Example |
|---|---|---|
| 0 bytes left over | none | Hi! (3 bytes) → SGkh |
| 1 byte | == | H → SA== |
| 2 bytes | = | Hi → SGk= |
How Much Bigger Is Base64?
Encoding always grows the data: 3 bytes become 4 characters, so the size overhead is about 33 percent before padding, and line breaks or quoting can add more. That's the price of safety in text-only channels, and it's why nobody Base64-encodes a video for storage — only for transport:
| Input size | Base64 output | Overhead |
|---|---|---|
| 3 bytes | 4 chars | +33% |
| 100 bytes | 136 chars | +36% |
| 1 KB (1,024 B) | 1,368 chars | +34% |
| 1 MB (1,048,576 B) | 1,398,104 chars | +33% |
The percentage wobbles a little on tiny inputs because padding and minimum lengths dominate; past a kilobyte it settles at one third. A data URI in CSS works the same way — an inline Base64 image makes the stylesheet about a third heavier than the equivalent file, which is a fair trade for removing an HTTP request and a poor one for a hero image.
What is URL-safe Base64?
Standard Base64 uses + and / characters, which have special meanings in URLs. URL-safe Base64 replaces + with - and / with _, making the output safe to embed in URLs, filenames, and query parameters without encoding. Toggle the "URL-safe" checkbox to use this variant.
The URL-safe variant is the house style inside JSON Web Tokens: a JWT's three dot-separated segments are Base64url without padding, so the token can travel in a URL header without any character needing percent-encoding.
Where Base64 Shows Up
| Context | What it's doing |
|---|---|
| Email attachments (MIME) | Carries images and documents through servers that only handle text |
| Data URIs | Embeds small images directly in HTML or CSS: data:image/png;base64,... |
| JWTs (JSON Web Tokens) | Encodes the header and claims segments in URL-safe Base64 |
| HTTP Basic authentication | Sends username:password as a single Base64 blob in the header |
| Config files and env vars | Puts binary secrets into formats that only accept one-line strings |
Is Base64 Encryption?
No, and this trips people up constantly. Base64 is an encoding, not encryption — there's no key, and anyone can reverse it instantly. Storing a Base64-encoded password is the same as storing it in plain text with extra steps. It solves a character-set problem, not a confidentiality problem.
How to Encode and Decode Base64
To encode, paste your text into the input field on the left — the Base64 output appears instantly on the right. To decode, switch to decode mode and paste your Base64 string. Our tool handles UTF-8 characters (emojis, accented letters, CJK) correctly by encoding the UTF-8 byte sequence, not just the ASCII characters. It also strips whitespace before decoding, so strings copied from certificates or logs with line breaks still work.
Is My Data Safe?
Yes. All encoding and decoding happens entirely in your browser using JavaScript. No data is ever sent to a server, stored, or logged. You can even use this tool offline once the page has loaded.
Frequently Asked Questions
Why does Base64 make files bigger?
Every 3 bytes of input become 4 characters of output, so the text is always about a third longer than the binary it represents, plus up to 2 padding characters. The overhead is the cost of representing 8-bit data with a 6-bit alphabet.
What does the = at the end of a Base64 string mean?
It's padding. When the input length isn't a multiple of 3 bytes, the last group is short, and one or two = characters fill the output to a multiple of 4 so the decoder knows how many real bytes to emit. A string ending in == came from input with 1 byte left over; one = means 2 bytes were left over.
Can Base64 be decoded without a key?
Always. Base64 is an encoding, not encryption — there is no key and no secret. Anyone with the string can recover the original data, so never treat it as a way to hide passwords or tokens.
What's the difference between Base64 and Base64url?
Only two characters. Standard Base64 uses + and / as alphabet values 62 and 63; the URL-safe variant swaps them for - and _ so the output can sit inside a URL without percent-encoding. JWTs use Base64url and usually omit padding.
Why did my Base64 string fail to decode?
Usually an invalid character — anything outside the 64-character alphabet (plus = padding) breaks it. Common causes are truncation from copy-paste, URL-decoded + signs turned into spaces, or a hex or ASCII-art string that was never Base64 to begin with. This tool strips whitespace automatically and accepts both alphabets.