What Is Base64 Encoding and How Does It Work?

Q: Is Base64 a form of encryption?

No. Base64 is an encoding scheme, not encryption. Anyone who receives Base64-encoded data can decode it instantly without a key. It provides no confidentiality — it exists purely to make binary data safe for text-based transmission.

Q: How much larger does Base64 make the data?

Base64 increases data size by approximately 33%. Every 3 bytes of binary input become 4 characters of Base64 output. A 1MB image embedded as Base64 in HTML becomes approximately 1.37MB of text.

Q: What is the difference between Base64 and Base64url?

Standard Base64 uses + and / characters which have special meaning in URLs. Base64url substitutes - for + and _ for /, making it safe to use in URLs and filenames without encoding. JWTs use Base64url.

Q: When should I use Base64 for images?

Inline Base64 images make sense for very small images (icons under 1–2KB) where the HTTP request overhead exceeds the size increase. For larger images, a CDN-hosted file is always more efficient.

The Problem Base64 Solves

Computers store everything as binary — sequences of 0s and 1s. When you need to send binary data (an image, a PDF, a certificate) through a system designed to handle text — an email, an HTTP header, a JSON API, an XML document — you have a problem. Many text-based protocols cannot reliably handle arbitrary binary bytes. Characters like null bytes, control characters, or bytes above 127 can corrupt or terminate the transmission.

Base64 solves this by converting binary data into a safe subset of 64 printable ASCII characters that travel reliably through any text-based system.

How Base64 Works

Base64 uses a 64-character alphabet: A–Z (26), a–z (26), 0–9 (10), plus + and / (2). The encoding process works in three steps:

Take the binary input and group it into chunks of 3 bytes (24 bits).
Split each 24-bit chunk into four 6-bit groups.
Map each 6-bit value (0–63) to the corresponding character in the Base64 alphabet.

If the input is not divisible by 3, padding characters (=) are added to make the output length a multiple of 4.

A worked example

Encoding the text "Man":

Text: M a n
ASCII: 77 97 110
Binary: 01001101 01100001 01101110
Groups: 010011 | 010110 | 000101 | 101110
Values: 19 | 22 | 5 | 46
Base64: T | W | F | u → TWFu

Every 3 bytes of input becomes exactly 4 characters of Base64 output — a 33% size increase.

Where You'll See Base64 in the Wild

Email attachments — MIME encoding uses Base64 to attach files (images, PDFs, spreadsheets) to email messages that only support ASCII text in transit.
Data URIs — inline images in HTML/CSS: src="data:image/png;base64,iVBORw0KGgo..." — avoids an extra HTTP request for small icons.
JSON Web Tokens (JWTs) — the header and payload sections of a JWT are Base64url-encoded (a URL-safe variant). This is why JWTs look like garbled text with dots.
HTTP Basic Authentication — credentials in the format username:password are Base64-encoded in the Authorization header.
Cryptographic certificates — PEM files (SSL/TLS certificates, SSH keys) are Base64-encoded DER format wrapped in -----BEGIN CERTIFICATE----- headers.
API responses — some APIs return binary data (images, audio) as Base64 strings embedded in JSON to avoid multipart responses.

Base64 Is Not Encryption

This is the most common misconception. Base64 is purely an encoding scheme — it is completely reversible by anyone without any key or secret. Seeing Base64 in an HTTP header does not mean credentials are protected. HTTP Basic Auth, for example, encodes credentials in Base64 but is effectively plaintext unless the connection uses HTTPS.

For actual confidentiality, you need encryption (AES, RSA, etc.). Base64 just makes binary data text-safe.

Base64url: The URL-Safe Variant

Standard Base64 uses + and /, which have special meanings in URLs (+ = space, / = path separator). Base64url substitutes:

+ → -
/ → _
Padding = is often omitted

This makes Base64url safe to use in URLs, filenames, and query parameters without percent-encoding. JWTs, OAuth tokens, and many modern APIs use Base64url rather than standard Base64.

Encoding and Decoding in Code

JavaScript (browser)

btoa("Hello, World!") // → "SGVsbG8sIFdvcmxkIQ=="
atob("SGVsbG8sIFdvcmxkIQ==") // → "Hello, World!"

Python

import base64
base64.b64encode(b"Hello") # → b'SGVsbG8='
base64.b64decode("SGVsbG8=") # → b'Hello'

Command line

echo -n "Hello" | base64 # → SGVsbG8=
echo "SGVsbG8=" | base64 --decode # → Hello

FAQ

Is Base64 a form of encryption?

No. Base64 is encoding, not encryption. Anyone who receives Base64 data can decode it instantly without any key. It provides zero security or confidentiality — it exists purely to represent binary data safely as printable ASCII text. Never use Base64 to protect sensitive information.

How much larger does Base64 make the data?

Exactly 33% larger. Every 3 bytes of input produce 4 characters of output (plus padding). A 1MB image embedded as Base64 in HTML becomes approximately 1.37MB of text. This is why inline Base64 images are only efficient for very small assets like icons.

What is the difference between Base64 and Base64url?

Standard Base64 uses + and / which are special URL characters. Base64url substitutes - for + and _ for /, making it safe in URLs and filenames without percent-encoding. It also usually omits the = padding. JWTs and most modern OAuth tokens use Base64url.

When should I use Base64 for images?

Inline Base64 images make sense for very small assets (icons under ~1–2KB) where the HTTP request round-trip overhead outweighs the 33% size increase. For anything larger, serving images from a CDN is more efficient — browsers cache them, they compress well with HTTP/2, and they don't bloat HTML/CSS file sizes.

Try the Base64 Encoder / Decoder Instant encode and decode — runs entirely in your browser

Open Tool →