Base64 Encode & Decode

What Base64 Is and Why It Exists

Base64 is a binary-to-text encoding scheme. It takes raw bytes - the kind of data that makes up images, archives, cryptographic keys, or anything else that is not plain readable text - and rewrites them using a small, safe alphabet of 64 printable characters: the 26 uppercase letters A-Z, the 26 lowercase letters a-z, the ten digits 0-9, and two extra symbols, usually + and /. An equals sign is used for padding at the end. Because every character it produces is ordinary ASCII, the result can travel through systems that were only ever designed to handle text.

That is the whole reason Base64 was invented. Many older protocols - email being the classic example - assume the content they carry is text. If you hand them raw binary, some bytes get mangled, stripped, or interpreted as control characters, and the data arrives corrupted. Base64 sidesteps the problem by converting the bytes into a form that any text-safe channel will pass through untouched. The original data can then be reconstructed exactly on the other side.

How the Conversion Works

Mechanically, Base64 groups the input into chunks of three bytes - that is 24 bits - and then re-slices those same 24 bits into four groups of six bits each. Six bits can represent 64 possible values, which is exactly why the alphabet has 64 characters. So three bytes of input always become four characters of output. When the input length is not a clean multiple of three, the encoder pads the final group with one or two = characters so a decoder knows where the real data ends.

This four-for-three ratio is also where the famous size penalty comes from: Base64 output is roughly 33% larger than the original data. If the encoded text is wrapped into fixed-width lines, as email standards often require, you pay a few extra percent on top of that for the line breaks. The overhead is the price of compatibility, and for most uses it is a fair trade.

Where You Run Into Base64

Once you know what to look for, Base64 shows up everywhere in everyday computing:

• Data URIs. A small image or font can be embedded directly into HTML or CSS with a data: URI, with the file contents written out as Base64. The browser decodes it inline, saving a separate network request.
• Email attachments. MIME, the standard that lets email carry files, leans on Base64 to move binary attachments through a text-only mail system without damage.
• HTTP Basic authentication. The familiar Authorization: Basic ... header is just a username and password joined by a colon and Base64-encoded - which is exactly why Basic auth must always run over HTTPS.
• Tokens and config. JSON Web Tokens, certificates, SSH keys, and countless configuration values are stored or transmitted as Base64 so they survive copy-paste and text-based storage.

Encoding Is Not Encryption

This is the single most important thing to understand, and it trips up beginners and seasoned developers alike. Base64 is not encryption and provides no security at all. There is no secret key, no password, and nothing private about it. The transformation is fully public and completely reversible: anyone who sees a Base64 string can decode it back to the original bytes in a second, using a tool exactly like this one.

So Base64 is a poor hiding place for passwords, API keys, or any sensitive value. If a string merely looks scrambled, that does not make it protected. Encryption, by contrast, transforms data with a secret key so that only someone holding that key can read it. The two solve different problems: encryption protects confidentiality, Base64 protects compatibility. They are often used together - you might encrypt data with AES and then Base64-encode the ciphertext so it can travel through a text channel - but one is never a substitute for the other.

Encode vs Decode

The two directions are simple mirror images. Encoding takes your original text or binary and produces the Base64 character string. Decoding takes a Base64 string and reconstructs the exact original bytes. Our tool does both directly in your browser - nothing you type or paste is ever sent to a server, so the operation is entirely local and private. That makes it safe to decode a token you are debugging or encode a snippet you want to embed, without your data leaving the page.

For related conversions, see our URL encode/decode tool for percent-encoding, or the JWT decoder when you need to inspect the Base64 segments inside a token. You will find these alongside the rest of our developer tools.

Frequently asked questions