How Base64 Encoding Works (and When to Use It)

Computers store everything — images, fonts, PDFs, zipped archives — as raw bytes. But a lot of the channels we move data through were built for plain text: email bodies, URLs, JSON documents, HTML attributes. Drop raw binary into one of those and it can get mangled, truncated, or rejected. Base64 is the fix. It represents binary data using just 64 printable ASCII characters, so the data survives any text-only channel untouched.

You have almost certainly seen it without knowing: a long, slightly random-looking string ending in one or two = signs. This guide explains what that string actually is, how the conversion works, and — importantly — what Base64 does not do.

How the conversion works

Base64 draws from a fixed alphabet of 64 characters: the uppercase letters A–Z, the lowercase letters a–z, the digits 0–9, and two extras, + and /. That is 64 symbols, and 64 is exactly 2⁶ — which is the whole trick.

The encoder works in groups of 3 bytes at a time. Three bytes is 24 bits. Instead of splitting those 24 bits into the usual four 8-bit chunks, Base64 re-slices them into four 6-bit groups. Each 6-bit group is a number from 0 to 63, and each number maps to one character in the alphabet. So every 3 bytes of input become exactly 4 characters of output.

That ratio is also why Base64 output is about 33% larger than the original: you get 4 output characters for every 3 input bytes.

Of course, not every input is a tidy multiple of 3 bytes. When the last group has only 1 or 2 bytes left over, the encoder pads the missing bits with zeros to fill out a 6-bit group, then appends = characters so the output stays a multiple of four. One leftover byte produces two = signs; two leftover bytes produce one. That is what the trailing equals signs mean — they are padding, not data.

Base64 is encoding, not encryption

This is the single most important thing to understand, and it is the mistake people make most often. Base64 is not secret and not secure. It is a reversible transformation with no key, so anyone can decode it in seconds — your browser can do it, every programming language can do it, and so can this site's own tool. It hides nothing.

Never use Base64 to "protect" a password, a token, an API key, or anything else that needs to stay confidential. Encoding makes data safe to transport; encryption makes data safe to expose. They are not the same thing, and treating one as the other is a genuine security bug.

Where you will run into it

Once you know the shape, you start seeing Base64 everywhere:

Data URIs. A small icon or font can be embedded directly in CSS or HTML as data:image/png;base64,…, saving a separate network request.
Email attachments. The MIME standard uses Base64 to carry images and files inside an email, which is fundamentally a text format.
JSON Web Tokens (JWTs). The header and payload of a JWT are Base64url-encoded JSON — readable by anyone, which is exactly why you never put secrets in them.
HTTP Basic Auth. The Authorization header sends username:password as Base64 — again, encoded, not encrypted, which is why Basic Auth relies on HTTPS to actually be safe.
Binary inside JSON or XML. When a document format has no native way to hold raw bytes, Base64 lets you tuck binary data into a plain string field.

A quick word on Base64url

The standard alphabet uses + and /, but those two characters have special meanings inside URLs and filenames. Base64url is a small variant that swaps them for - and _, so the result can be dropped into a web address without being mangled or needing extra escaping. It is the same idea with two safer symbols — and it is what JWTs use.

When to use it (and when not to)

Reach for Base64 whenever you need to move binary data through a text-only pipe: embedding a tiny asset, stuffing bytes into a JSON field, or reading a token. But remember the 33% size tax. Do not Base64 large images into your HTML or CSS. It bloats the file, the inlined data cannot be cached separately by the browser, and every page load re-downloads it. For anything beyond a small icon, link to the real file and let the browser cache it.

Encode or decode Base64 instantlyConvert text and data both ways right in your browser — nothing is uploaded anywhere.

Open Base64 & Hash Tool →

The takeaway

Base64 is a simple, elegant bridge between the binary world computers live in and the text world so many of our tools expect. It is cheap, universal, and completely reversible — which is its strength for transport and its downfall as a security measure. Use it to move bytes safely through text, keep an eye on the size cost, and never, ever mistake it for a lock.