What is Base64 Encoding?
technologyDefinition
Base64 is an encoding scheme that converts binary data (files, images, strings) into a 64-character ASCII text format using A–Z, a–z, 0–9, +, and /. It is used to safely transmit binary data over text-based protocols like HTTP, email (MIME), and JSON APIs. Base64 output is always approximately 33% larger than the original input.
Detailed Explanation
Binary data contains bytes that can't be reliably transmitted over systems designed for text (because some byte values represent control characters). Base64 solves this by encoding every 3 bytes of binary data into 4 printable ASCII characters — making it safe for any text-based transmission.
Common use cases: embedding images directly in CSS/HTML as data URIs (background-image: url('data:image/png;base64,...')), encoding credentials in HTTP Basic Authentication headers, encoding file attachments in email (MIME format), and storing binary data in JSON APIs.
Base64 is NOT encryption — it is an encoding scheme. The data can be decoded by anyone with the encoded string. Never use Base64 for security-sensitive data without additional encryption.
How Base64 encoding works, step by step
Base64 reads the input three bytes (24 bits) at a time and splits those bits into four groups of six. Each six-bit group maps to one of 64 safe characters. The text 'Man' becomes 'TWFu', and 'Hello' becomes 'SGVsbG8='.
When the input length is not a multiple of three, the output is padded with one or two '=' characters. That is why you often see Base64 strings ending in '=' or '=='. The output is about a third larger than the input, since three bytes become four characters.
Where developers actually use it
Typical uses include small inline images in HTML or CSS (data URIs), file attachments in email, binary values inside JSON, and the credentials in an HTTP Basic Authentication header. JSON Web Tokens use a URL-safe variant that swaps '+' and '/' for '-' and '_' and drops the padding.
Try it yourself with the Base64 Encoder and Base64 Decoder. Data is processed in your browser, so what you paste is not sent to a server.
Base64 is not security
Anyone can decode a Base64 string in a second, so it hides nothing. A password stored as Base64 is effectively stored in plain text. If you need secrecy use real encryption, and for passwords use a slow salted hash such as bcrypt or Argon2.
Base64 also costs size. For large files, embedding as Base64 increases page weight by about 33% and bypasses caching, so use it only for small assets. For URL-related encoding see the URL Encoder.
🔐 Base64 Encoder
Encode text/files to Base64