If you have ever seen a long string of letters and numbers ending in one or two equals signs, you have probably met Base64. It is one of the most common encodings on the internet, and one of the most misunderstood. This guide explains what it does, where it is used and what it is not.
What Base64 does
Computers can store any kind of data as bytes, but many systems, such as email, JSON and URLs, were designed to carry plain text. Base64 converts bytes into a limited set of 64 safe characters: the letters A to Z and a to z, the digits 0 to 9, and the symbols + and /. The result can pass through text-only systems without being damaged.
How it works in brief
Base64 reads the data three bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which is mapped to one of the 64 characters. If the data does not divide evenly into groups of three bytes, the output is padded with one or two equals signs at the end. For example, the text Hi becomes SGk=.
Why the output is bigger
Three bytes become four characters, so Base64 data is about 33 percent larger than the original. That is the cost of making binary data text-safe. Encoding something twice makes it even larger, so it should be done only when needed.
Where you will see Base64
- Email attachments. The MIME standard uses Base64 to carry files inside text-based messages.
- Data URIs. Small images can be embedded directly in HTML or CSS as
data:image/png;base64,.... - APIs and JSON. Binary content, such as a small file or signature, is often sent as a Base64 string.
- Tokens. The readable parts of a JSON Web Token (JWT) use a URL-safe variant of Base64.
- HTTP Basic authentication. The username and password are Base64 encoded, which is why that method must only be used over HTTPS.
Base64 is not encryption
This is the most important point. Base64 has no key and no secret. Anyone can decode it instantly, including with our Base64 Encoder Decoder. Never use it to hide passwords, personal information or anything sensitive. If you need secrecy, use real encryption. If you need to check whether data was changed, use a hash, as explained in our guide to hashing versus encryption.
The URL-safe variant
The standard alphabet includes + and /, which have special meanings in URLs. URL-safe Base64 replaces them with - and _ and often omits the = padding. If a decoded string looks wrong, check which variant it uses.
When not to use Base64 for images
Embedding an image as Base64 can be handy for a tiny icon, because it saves a network request. For larger images it is usually a poor choice: the HTML or CSS file gets about a third bigger, the browser cannot cache the image separately, and the page becomes slower to parse. Use a normal image file for anything bigger than a few kilobytes. To embed a small one, try our Image to Base64 tool, which creates the data URI, HTML tag or CSS snippet for you.
Common problems
- Invalid characters. Line breaks or spaces inserted while copying can break decoding.
- Missing padding. Some systems drop the equals signs; add them back if the decoder complains.
- Wrong text encoding. Decoded bytes may be UTF-8 text. If accented or non-English characters look garbled, the text encoding was probably mishandled before encoding.
Frequently asked questions
Is Base64 secure?
No. It is a reversible encoding with no key, so anyone can decode it. Use real encryption when you need secrecy.
Why does Base64 often end with equals signs?
They are padding that completes the last group of four characters when the data length is not a multiple of three bytes.
Can Base64 make a file smaller?
No. It makes data about 33 percent larger. To reduce size, use compression such as ZIP or an image compressor.