Base64 is an encoding scheme that converts binary data into a string of 64 printable ASCII characters. It does not encrypt data it simply makes binary content safe to transmit through systems that only handle text, such as email (MIME) or JSON APIs. Encode or decode any string instantly with the Base64 Encoder/Decoder.
How Base64 Works
Base64 takes three bytes of binary input (24 bits) and outputs four Base64 characters (6 bits each). The character set consists of A–Z, a–z, 0–9, +, and /. The = character is used for padding when the input is not divisible by 3 bytes.
The result is approximately 33% larger than the original. A 10 KB image becomes ~13.3 KB when Base64-encoded. This overhead matters for performance-sensitive applications.
When to Use Base64
- Email attachments SMTP handles text only; binary files are Base64-encoded by MIME
- Data URLs embed small images directly in HTML or CSS:
src="data:image/png;base64,..." - API payloads when JSON needs to carry binary data (files, images, certificates)
- JWT payload encoding JWT uses Base64URL (a variant with
-and_replacing+and/). See our JWT Decoder - Basic Auth headers HTTP Basic authentication encodes
username:passwordas Base64
When Not to Use Base64
Base64 is not encryption. Do not use it to "hide" sensitive data it is trivially decoded. Also avoid using it for large files in web payloads (the 33% overhead is significant), and do not use it when a binary-safe transport layer is available.
For sensitive data storage, use proper encryption. For URL-safe encoding of text strings, use URL percent-encoding instead.
Base64 vs Base64URL
Standard Base64 uses + and /, which are special characters in URLs. Base64URL substitutes - for + and _ for /, and typically omits padding. This variant is used in JWTs, OAuth tokens, and PKCE code challenges. The encoder supports both modes.
Frequently Asked Questions
Is Base64 the same as encryption?
No. Base64 is encoding, not encryption. Anyone who sees a Base64-encoded string can decode it immediately there is no key or secret involved. According to RFC 4648, Base64 is defined purely as a binary-to-text encoding scheme, with no security properties.
Why does Base64 end with == sometimes?
Padding. Base64 encodes 3 bytes at a time into 4 characters. If the input length is not a multiple of 3, one or two = characters are appended to pad the output to a multiple of 4 characters. Some implementations omit padding (especially Base64URL variants).
How do I decode Base64 in JavaScript?
Use the built-in atob() function: atob('SGVsbG8gV29ybGQ=') returns 'Hello World'. For encoding, use btoa(). For Node.js, use Buffer.from(str, 'base64').toString(). The MDN atob() documentation covers browser compatibility.