Base64 Encoder / Decoder

How Base64 Encoding Works: Use Cases, Security, and Implementation

Base64 is a binary-to-text encoding scheme that converts binary data into a string of 64 printable ASCII characters. It is one of the most commonly used encoding methods on the web, appearing in email attachments, data URIs, API authentication, and more.

How Base64 Encoding Works

Base64 takes every 3 bytes (24 bits) of input and splits them into 4 groups of 6 bits each. Each 6-bit group maps to one of 64 characters: A-Z (0-25), a-z (26-51), 0-9 (52-61), + (62), and / (63). If the input length is not a multiple of 3, padding characters (=) are added.

Common Use Cases

• Email (MIME): Email was designed for ASCII text. Base64 encodes binary attachments (images, PDFs) so they can travel through text-only email systems.
• Data URIs: Embedding small images directly in HTML/CSS: data:image/png;base64,iVBOR... This eliminates an HTTP request.
• HTTP Basic Auth: Credentials are sent as Base64(username:password) in the Authorization header.
• API payloads: Binary data (files, images) sent in JSON must be Base64-encoded since JSON only supports text.
• JWT tokens: JSON Web Tokens use Base64url encoding (URL-safe variant) for the header and payload sections. See our Base64 encoding explained guide for deeper examples.

Important: Base64 Is NOT Encryption

Base64 is an encoding, not encryption. It is trivially reversible - anyone can decode a Base64 string. Never use Base64 to "hide" passwords, API keys, or sensitive data. It provides zero security. For actual security, use AES encryption, bcrypt (for passwords), or TLS for data in transit.

Size Overhead

Base64 increases data size by approximately 33%. A 1 MB file becomes about 1.33 MB when Base64-encoded. This is because 3 bytes of input become 4 bytes of output. For large files, this overhead is significant - use binary transfer methods instead of Base64 when possible.

Base64 Variants

• Standard (RFC 4648): Uses +, /, and = padding. The most common variant.
• URL-safe: Replaces + with - and / with _. Used in URLs and filenames where + and / have special meaning.
• MIME: Adds line breaks every 76 characters. Used in email.