Base64 is a binary-to-text encoding scheme that represents binary data as a string of ASCII characters, using a 64-character alphabet of uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), plus (+), and slash (/). The equals sign (=) is used for padding.
How it works
Base64 takes every 3 bytes (24 bits) of input and splits them into 4 groups of 6 bits each. Each 6-bit group maps to one of the 64 characters in the alphabet. If the input length isn’t divisible by 3, the output is padded with one or two = characters.
This means Base64-encoded data is always about 33% larger than the original. Three bytes become four characters — that’s the trade-off for safe text transmission.
Original: Hello
Binary: 01001000 01100101 01101100 01101100 01101111
Base64: SGVsbG8=Why developers use Base64
Base64 exists to safely transmit binary data through text-only channels. Email attachments use it (MIME encoding). Data URIs embed images directly in HTML or CSS using Base64. JSON payloads that need to carry binary data — file uploads, cryptographic keys, image thumbnails — encode that data as Base64 strings.
JWTs (JSON Web Tokens) use a URL-safe variant called Base64URL, which swaps + and / for - and _ and drops the padding. This makes the encoded string safe for URLs and headers.
Common use cases
- Embedding small images in CSS:
background-image: url(data:image/png;base64,...) - Sending file attachments in API requests as JSON fields
- Encoding credentials in HTTP Basic Authentication headers
- Storing binary blobs in text-based databases or config files
Practical examples
In JavaScript: btoa('Hello') returns "SGVsbG8=", and atob('SGVsbG8=') returns "Hello". In Python: base64.b64encode(b'Hello'). On the command line: echo -n 'Hello' | base64.
You can encode and decode Base64 strings with the Base64 Encoder/Decoder, or convert images directly with Image to Base64. Working with JWTs? The JWT Decoder handles Base64URL automatically.
When not to use Base64
Base64 is not encryption. It provides zero security — anyone can decode it. Don’t use it to “hide” sensitive data. Also avoid it for large files; the 33% size overhead adds up fast. For transferring large binaries, use proper multipart uploads instead.