Base64 shows up everywhere in development: in embedded images, in tokens, in HTTP headers, in emails. But many people confuse it with encryption or don't know what it's really for. This guide clears it up with practical examples.
What is Base64
Base64 is an encoding system that converts binary data (or text) into a string of just 64 safe ASCII characters: A-Z, a-z, 0-9, + and /. Its goal is to represent data that could "break" when traveling through systems designed only for text.
For example, the text Hola becomes SG9sYQ==.
Base64 is NOT encryption
This is the most important misunderstanding: Base64 protects nothing. It's reversible by anyone, without a key. If you encode a password in Base64, anyone can decode it instantly. Base64 is for transporting data, not for hiding it.
If you need to protect information, you need encryption (like AES), not Base64.
How it works (the idea)
Base64 groups data into blocks of 3 bytes (24 bits) and splits them into 4 groups of 6 bits. Each 6-bit group (ranging 0 to 63) maps to one of the 64 characters. That's why the result is 33% larger than the original: it turns 3 bytes into 4 characters.
The = at the end is padding to fill in when the data isn't a multiple of 3 bytes.
What Base64 is used for
1. Embedded images (data URIs)
You can embed an image directly in HTML or CSS without a separate file:
<img src="data:image/png;base64,iVBORw0KGgo..." />
Useful for small icons: it saves an HTTP request. For large images it's not worth it (the +33% size).
2. Sending binary data over text channels
Emails (attachments), JSON (which doesn't allow binary), some HTTP headers… all use Base64 to fit binary where only text fits.
3. Tokens and encoded credentials
HTTP basic authentication encodes user:password in Base64 (that's why it needs HTTPS: Base64 isn't secure by itself). JWTs also use Base64URL for their parts.
Base64 vs Base64URL
There's a variant, Base64URL, that replaces the + and / characters (problematic in URLs) with - and _, and usually omits the = padding. It's used in JWTs and URL parameters. If a regular Base64 errors in a URL, try the URL-safe variant.
How to encode and decode Base64
- Paste your text or upload a file.
- Choose encode or decode.
- Get the result instantly.
You can do it free with the Base64 encoder on this site, which processes everything in your browser.
Frequently asked questions
Is Base64 secure? No. It's reversible encoding, not encryption. Don't use it to protect data.
Why does my Base64 string end in = or ==? That's the padding. It indicates how many bytes were filled to complete the last block.
Why does the result weigh more than the original? Base64 adds about 33% size. It's the cost of representing binary as text.
Is my data uploaded when encoding? No, if you use a local tool. Everything happens in your browser.
Encode and decode text and images instantly with the free Base64 encoder, 100% in your browser and uploading nothing.