What Base64 Is For
Base64 represents binary data using only 64 printable ASCII characters. It exists because many systems — email, URLs, XML, JSON, HTTP headers — were designed for text and mishandle arbitrary bytes. Encoding binary as text lets it pass through them intact.
It is not encryption. Base64 provides no security whatsoever; anyone can decode it instantly, as this page demonstrates. Its purpose is safe transport, not confidentiality.
How the Encoding Works
Base64 takes three bytes (24 bits) and splits them into four 6-bit groups, each of which indexes into a 64-character alphabet.
| Step | Example with "Man" |
|---|---|
| ASCII bytes | 77, 97, 110 |
| Binary (24 bits) | 01001101 01100001 01101110 |
| Split into 6-bit groups | 010011 010110 000101 101110 |
| As decimal | 19, 22, 5, 46 |
| Mapped to the alphabet | T, W, F, u |
| Result | TWFu |
The alphabet is A–Z, a–z, 0–9, then + and /. Six bits give 64 possible values, which is where the name comes from.
Padding
When the input length is not a multiple of three, the encoder pads the output with = characters so the result is always a multiple of four.
| Input bytes | Output | Padding |
|---|---|---|
| 3 | 4 characters | None |
| 2 | 3 characters + = | One = |
| 1 | 2 characters + == | Two = |
The 33% Overhead
Four characters for every three bytes means Base64 output is always 4/3 the size of the input, before padding — a 33% increase. This is the fundamental cost of the encoding and cannot be avoided.
| Original | Base64 | Increase |
|---|---|---|
| 1 KB | 1.37 KB | +37% |
| 100 KB | 133 KB | +33% |
| 1 MB | 1.33 MB | +33% |
| 10 MB | 13.3 MB | +33% |
This is why inlining large images as Base64 data URIs is usually a mistake: the file grows by a third, and unlike a separate image file, it cannot be cached independently.
Standard and URL-Safe Alphabets
| Standard (RFC 4648 §4) | URL-safe (RFC 4648 §5) | |
|---|---|---|
| Character 62 | + | - |
| Character 63 | / | _ |
| Padding | = required | = usually omitted |
| Used in | Email, general encoding | URLs, filenames, JWTs |
The standard alphabet breaks inside URLs, because + means a space in query strings and / is a path separator. The URL-safe variant substitutes characters that carry no special meaning.
Where You Will Encounter It
- Email attachments — MIME encodes binary attachments as Base64, which is the original use case.
- Data URIs —
data:image/png;base64,…embeds an image directly in HTML or CSS. - HTTP Basic authentication — the username and password are Base64 encoded, which is exactly why Basic auth must only be used over HTTPS.
- JSON Web Tokens — the header and payload are URL-safe Base64, readable by anyone; only the signature is protected.
- API keys and certificates — PEM files are Base64-encoded DER between BEGIN and END markers.
Common Problems
- Missing padding. Many decoders reject input whose length is not a multiple of four. This tool adds the padding back automatically.
- Line breaks. MIME inserts a newline every 76 characters. Strict decoders reject them; most tolerate them.
- Wrong alphabet. Decoding URL-safe Base64 with a standard decoder fails on - and _ characters.
- Unicode confusion. Base64 encodes bytes, not characters. Text must be converted to UTF-8 first, which this tool does — a character such as é is two bytes, not one.
Frequently Asked Questions
Is Base64 secure?
No. It is an encoding, not encryption, and reverses in a fraction of a second. Never use it to protect anything sensitive.
Why does my encoded string end in = signs?
Padding, added when the input length is not a multiple of three. One = means the last group held two bytes; two = means it held one.
Can I Base64 encode an image?
Yes, and that is what a data URI does. Be aware of the 33% size penalty and the loss of independent caching; it is worth it only for very small images such as icons.
Is my text sent anywhere?
No. The conversion happens entirely in your browser using its built-in functions. There is no network request and nothing is stored.