What Is Base64? Encoding and Decoding Explained

Base64 is a way of writing any data, even images and files, using only 64 safe text characters. You meet it in email attachments, data URLs, JSON Web Tokens, API keys and config files. It is easy to confuse with encryption, and that confusion causes real security mistakes, so it is worth understanding properly.

How Base64 works

Computers store data as bytes (8 bits each). Base64 takes three bytes (24 bits) at a time and splits them into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which is mapped to one character from this alphabet:

A–Z   (0–25)
a–z   (26–51)
0–9   (52–61)
+ and / (62, 63)
=     padding at the end

Example: the text Man is the bytes 77, 97, 110. Regrouped as 6-bit numbers they are 19, 22, 5, 46, which map to TWFu. So Man becomes TWFu. When the data is not a multiple of three bytes, = signs pad the end.

Encode text or a file to Base64, or decode it back, in your browser.Open Base64 Encoder →

Why it exists

Many systems were built to carry plain text only. Raw binary data can contain bytes that look like control characters and get corrupted or rejected. Base64 turns any binary data into text that passes through email, JSON, XML and URLs untouched.

The cost: about 33% bigger

Three bytes become four characters, so Base64 output is roughly one third larger than the original. A 300 KB image becomes about 400 KB of text. That is fine for tiny icons, but a poor choice for big images on a web page.

Where you will see it

Data URLs: data:image/png;base64,iVBOR… embeds a small image directly in HTML or CSS. Make one with Image to Base64.
JWTs: the header and payload are Base64URL (a variant using - and _ instead of + and /). See What is a JWT?
HTTP Basic auth: username:password is Base64 encoded in the header.
Email (MIME): attachments are encoded this way.

Base64 is not encryption. Anyone can decode it instantly, with no key. Never use it to hide passwords, tokens or personal data. Decoding a Base64 string in the Base64 Decoder takes a second.

Frequently asked questions

Why does my Base64 end with = signs?

They are padding, added so the length is a multiple of four. One or two = at the end is normal.

Why does decoding give strange characters?

The original data may not be text (it could be an image or a zip file), or it may use a different character encoding than the one assumed. Decode to a file instead of text in that case.

Is Base64URL the same thing?

Nearly. It swaps + and / for - and _ and often drops the padding, so it is safe inside URLs and file names.

What is Base64? Encoding and decoding explained