What Is Base64 Encoding? How It Works and When to Use It

The problem Base64 solves

Computers store files as bytes, and a byte can hold any value from 0 to 255. Many older and simpler channels were designed for plain text only. Email bodies, URLs, HTML attributes and JSON strings can break or mangle bytes that look like control characters, line endings or reserved symbols.

Base64 solves this by translating any sequence of bytes into a short alphabet of safe, printable characters. The receiver reverses the translation and gets the exact original bytes back. Nothing about the content is hidden or protected; it is only repackaged.

If you just need to convert something now, the Base64 encode and decode tool handles text and files in your browser.

How Base64 works

The standard alphabet has 64 characters: A–Z, a–z, 0–9, + and /. Each character stands for a number from 0 to 63, which fits in 6 bits.

The process is:

1. Take the input three bytes at a time (24 bits).
2. Split those 24 bits into four groups of 6 bits.
3. Look up each 6-bit value in the alphabet.

Three bytes in, four characters out.

Worked example: encoding “Man”

The letters M, a and n have ASCII values 77, 97 and 110.

Joined together, the bits are 010011010110000101101110. Regrouped into 6-bit chunks:

So Man becomes TWFu.

Padding with =

Input length is not always a multiple of three. Take Hello (5 bytes). The first three bytes, Hel, become SGVs. The remaining two bytes, lo, give 16 bits, which is padded with zero bits to 18 bits (three 6-bit groups) and produces bG8. A single = is added to bring the total to a multiple of four characters:

Hello  →  SGVsbG8=

One leftover byte produces two characters plus ==. Two leftover bytes produce three characters plus =.

Why the output is bigger

Because 3 bytes become 4 characters, the encoded text is about one third larger than the original, before counting line breaks some systems add. For a small icon that cost is usually acceptable. For a large photo or video it adds up quickly, so Base64 is not a storage or compression method.

Standard vs URL-safe Base64

The + and / characters cause trouble in URLs and file names, and = can need escaping in query strings. URL-safe Base64 (often called Base64url) makes two substitutions:

The data is otherwise identical. A decoder that expects one variant may reject the other, so check which one a system uses. The tool above offers a URL-safe option and an option to remove padding.

Where Base64 is used

• Data URIs. Small images or fonts can be embedded directly in HTML or CSS as data:image/png;base64,..., avoiding an extra request.
• Email attachments. Mail formats carry attachments as Base64 text.
• HTTP Basic authentication. The username:password pair is Base64-encoded in the header. That is formatting, not protection, which is why it should only be used over HTTPS.
• JWT segments. The header and payload of a JSON Web Token are Base64url-encoded JSON.
• JSON and XML payloads. Binary values such as small files are often sent as Base64 strings.

Base64 is not encryption

This is the most important point. Base64 has no key, no secret and no security. Decoding is a standard, public operation. Encoding a password, API key or personal data in Base64 only changes how it looks.

If data must be confidential, use proper encryption and secure transport. If you only need to avoid accidental tampering with the format, Base64 is fine.

Unicode and UTF-8 pitfalls

Base64 encodes bytes, not characters. To encode text, the text must first be converted to bytes, normally with UTF-8. Characters such as é or € take more than one byte in UTF-8, so the Base64 output is longer than the character count suggests.

Problems appear when the encoder and decoder disagree on the text encoding. A string encoded as UTF-8 and read back as another encoding shows garbled characters. Some browser functions for Base64 work only with single-byte characters and fail on others, which is why tools that handle UTF-8 explicitly are safer for non-English text. When decoding binary data that is not valid UTF-8 text, treat it as a file rather than text.

Common mistakes and error causes

• Treating Base64 as security. It protects nothing.
• Wrong or missing padding. Many decoders require the length to be a multiple of four. Removing or truncating = characters can cause an error.
• Stray whitespace or line breaks. Copying from emails or terminals can add spaces and newlines that some decoders reject.
• Mixing variants. Decoding URL-safe text with a standard-only decoder (or the reverse) fails because of -, _, + and /.
• Decoding binary as text. The result looks like noise because it is not text.
• Embedding large files. The one-third size increase and long strings make pages heavier.

Try it yourself

To see the examples above, paste Man or Hello into the Base64 encoder and decoder. The tool also encodes files and decodes Base64 back to text or a file, and the page states that your data stays in your browser.