What Is Base64? Binary-to-Text Encoding Explained
Learn what Base64 is, how it turns binary bytes into printable ASCII text, why padding and Base64URL exist, and where encoding stops being safe.
What is Base64?
Base64 is a binary-to-text encoding that represents arbitrary bytes using 64 printable ASCII characters. It does not encrypt anything: anyone with the encoded string can decode it back to the original bytes.
The encoding exists because many systems were designed to carry text, not raw binary. Email, URLs, JSON, XML, and HTTP headers can mangle bytes such as 0x00 or 0xFF. Base64 converts those bytes into a smaller alphabet of letters, digits, +, and / so they can pass through text-only channels intact. The format is standardized in RFC 4648.
What does Base64 look like?
The classic example is "Hello, world!", which becomes SGVsbG8sIHdvcmxkIQ==. The input is 13 bytes; the output is 20 characters, including two padding equals signs.
| Input | Bytes (hex) | Base64 |
|---|---|---|
| Hello, world! | 48 65 6C 6C 6F 2C 20 77 6F 72 6C 64 21 | SGVsbG8sIHdvcmxkIQ== |
| A | 41 | QQ== |
| AB | 41 42 | QUI= |
| ABC | 41 42 43 | QUJD |
The output is longer than the input. Every three input bytes become four output characters, so the encoded form is roughly 33% larger. Base64 is a compatibility layer, not compression.
What is Base64 used for?
Base64 shows up wherever binary data has to travel through a text-based system. Common examples include:
- Data URIs: embedding an image, font, or other asset directly in HTML or CSS as
data:image/png;base64,.... This removes a request but makes the document larger. - JSON and XML payloads: carrying a binary attachment inside a text document where a raw byte sequence would be invalid or unsafe.
- Email attachments: MIME encodes attachment data so it can pass through SMTP servers that expect text.
- HTTP Basic authentication: sending
username:passwordin anAuthorizationheader. The encoding makes the header text-safe; TLS is what protects it in transit. - JWTs: the header and payload are Base64URL-encoded JSON. Read the JWT decoding guide to see how that works and why decoding is not verification.
- Configuration stores: placing binary or arbitrary text in environments that only accept text. Kubernetes Secrets are a common example, but the encoding is not a security boundary.
How does Base64 encoding work?
Base64 reads the input as bytes and processes them in groups of three. Each group contains 24 bits, which is split into four 6-bit values. Those values are then looked up in the Base64 alphabet.
Bytes: M a n Hex: 4D 61 6E Bits: 01001101 01100001 01101110 6-bit: 010011 010110 000101 101110 Values: 19 22 5 46 Base64: T W F u
| 6-bit value | Character |
|---|---|
| 0–25 | A–Z |
| 26–51 | a–z |
| 52–61 | 0–9 |
| 62 | + |
| 63 | / |
Decoding reverses the process: map each character back to a 6-bit value, join the bits, and split the result into bytes. Text is not encoded character by character; it is first converted to bytes with a character encoding such as UTF-8. A multi-byte character therefore spans several input bytes.
Base64 encoding step by step
1. Convert the input to bytes
Base64 operates on bytes, not characters. Text is first encoded with a character encoding such as UTF-8, while images and files are already sequences of bytes.
2. Group the bytes in threes
Take three bytes at a time, which is 24 bits. If the final group is shorter, it is padded so it can still be processed as a complete group.
3. Split each group into four 6-bit values
Divide the 24 bits into four 6-bit numbers. Each number is between 0 and 63 and maps to one character in the Base64 alphabet.
4. Map the values to Base64 characters
Values 0 to 25 map to A-Z, 26 to 51 to a-z, 52 to 61 to 0-9, 62 to +, and 63 to /. A final group of one byte gets two = characters; two bytes get one.
5. Decode with the matching alphabet
Reverse the mapping to recover the original bytes. Use Base64URL instead of standard Base64 when the output must travel in a URL or a JWT, and never treat either form as encryption.
Why does Base64 use padding?
Padding keeps the output length a multiple of four. When the final group has only one or two bytes, the encoder adds = characters to fill the missing slots. The equals signs are not part of the original data and are discarded on decoding.
| Input length | Bytes in final group | Padding |
|---|---|---|
| Multiple of 3 | 3 | none |
| One byte left | 1 | == |
| Two bytes left | 2 | = |
Some decoders accept unpadded input, but standard Base64 includes the padding, and not every implementation is lenient. If you remove padding to build a URL-safe value, make sure the decoder on the other side expects that form.
What is URL-safe Base64?
Standard Base64 uses + and /, which can be ambiguous in a URL: a plus may be read as a space in form data, and a slash is a path separator. Base64URL (RFC 4648 §5) replaces them with - and _, and it commonly omits the padding.
| Bytes (hex) | Standard Base64 | Base64URL |
|---|---|---|
| FB FF | +/8= | -_8= |
Base64URL is still Base64, not encryption. Use it when the value must survive a URL, filename, or JWT segment, and use the matching decoder rather than mixing alphabets. If you need percent-encoding for other URL characters, see the URL encoding guide.
Is Base64 encryption?
No. Base64 is encoding, not encryption. It has no key, no secrecy, and no integrity protection. Encoding a password or API key in Base64 does not hide it; it only changes its representation. It is also not hashing, because hashing is one-way while Base64 is designed to be reversed.
Use the right tool for the risk: TLS for data in transit, a modern encryption scheme for confidential stored data, a password hash such as Argon2 or bcrypt for passwords, and an HMAC or digital signature when you need to detect tampering.
What are the security limitations of Base64?
- No confidentiality: anyone who can read the string can decode it. A Base64 secret in a URL, log, or repository is still exposed.
- No integrity checking: an attacker can decode, modify, and re-encode the data. Base64 cannot tell you whether the result is authentic.
- Size and memory overhead: encoded data is about a third larger, and decoding a very large or untrusted payload can consume significant memory. Cap input sizes before decoding.
- Format confusion: standard Base64 and Base64URL are not interchangeable. Validate the alphabet, padding expectations, and decoded length at the boundary.
A practical rule: treat Base64 as a transport format, not a trust boundary. If a value is sensitive, protect it with encryption and access controls before encoding it.
How do I encode or decode Base64?
The Base64 Encoder & Decoder runs entirely in your browser. Paste text to encode or decode it, choose the URL-safe variant when needed, use the Image tab to produce a data URI, or use the File tab to get plain Base64. Nothing is uploaded. When you are working with JSON that contains encoded payloads, the JSON formatting guide covers validation and conversion.
// Frequently Asked Questions
Is Base64 encryption?
No. Base64 is a reversible encoding with no key. Anyone can decode it back to the original bytes, so it provides no confidentiality. Use TLS for data in transit and a proper encryption scheme such as AES-GCM when you need to protect stored data.
Can I decode Base64 without a key?
Yes. A standard Base64 decoder only needs the encoded string and the correct alphabet. If the value was encrypted before it was Base64-encoded, you still need the decryption key, but the Base64 layer itself adds no protection.
Why does Base64 end with one or two equals signs?
The equals signs are padding. Base64 converts every three bytes into four characters. If one input byte is left over, two = characters complete the final four-character group; if two bytes are left over, one = character completes it. The output length then stays a multiple of four.
What is the difference between Base64 and Base64URL?
Base64URL is a URL-safe variant of Base64. It replaces + with - and / with _, and it usually omits padding = because those characters have special meanings in URLs. JWTs use Base64URL for their header and payload segments.
Does Base64 make data smaller?
No. Base64 makes data larger. Every three input bytes become four output characters, so the encoded form is about 33% bigger before any line breaks or metadata. It is a transport and text-safety trade-off, not compression.
Is it safe to store secrets as Base64?
No. Base64 only changes how bytes are represented, so a Base64-encoded password, API key, or token is just as readable as the original to anyone who can access it. Kubernetes Secrets, for example, are Base64-encoded by default and still need encryption at rest and strict access control.