Base64 Encoding: What It Is and When to Use It

Base64 is a method of encoding binary data into plain text using a set of 64 safe characters, so it can travel through systems that only handle text. If you have ever opened an HTML file and seen an image source that started with a giant block of random looking letters, or peeked at an email's raw source and found pages of gibberish, you have already met Base64. It is one of the most common building blocks on the modern web, defined in the internet standard RFC 4648. This guide explains what Base64 is, how it works, where it shows up, and one important thing it is not.

What exactly is Base64?

Base64 is a way to represent binary data as plain text. Computers store everything, images, audio, documents, as raw bytes. Those bytes can include any of 256 possible values, and many of those values are not printable characters. Some are control codes, some have special meaning in certain systems, and some get corrupted when passed through software that expects normal text. The Base64 term and encoding are defined in the glossary at MDN Web Docs.

Base64 solves this by re-encoding the data using only 64 characters that are safe almost everywhere: the uppercase letters A to Z, the lowercase letters a to z, the digits 0 to 9, and the two symbols + and /. A separate character, the equals sign, is used for padding. According to Wikipedia, this exact alphabet is what lets the result travel safely through email, URLs, JSON, XML, and other text-only channels without getting mangled.

How does Base64 encoding work?

The mechanism is simpler than it looks. Base64 works on the data in groups of 3 bytes at a time. Three bytes is 24 bits. Those 24 bits are then sliced into four groups of 6 bits each. Six bits can represent 64 different values, which is exactly why the alphabet has 64 characters. Each 6-bit group is mapped to one character, so every 3 bytes of input become 4 characters of output.

That ratio is the reason Base64 output is always about one third larger than the original data. You are trading size for safety. Here is the short version of the steps:

• Take 3 bytes (24 bits) of the original data
• Split those 24 bits into four 6-bit chunks
• Convert each chunk (a value from 0 to 63) into its matching character
• Repeat until all the data is processed

What happens when the data does not divide evenly into groups of 3? That is where the padding character comes in. If the final group has only 1 or 2 bytes left over, the encoder fills the gap and adds one or two = signs at the end so the output length is always a multiple of 4. So a string ending in == tells you the original input had one leftover byte, and a single = means it had two. Decoding simply reverses the process to rebuild the exact original bytes, which is why Base64 is completely lossless and reversible.

What are the common use cases for Base64?

Base64 is everywhere once you know to look for it. These are the situations where you will run into it most often.

Embedding images in HTML and CSS

You can encode an image as Base64 and drop it straight into a web page using a data URI, a scheme defined in RFC 2397. Instead of src="logo.png", you write src="data:image/png;base64,iVBORw0KGgo...". The whole image lives inside the HTML or CSS file, so the browser skips a separate network request. That is handy for small icons and logos under about 5KB, per Base64.sh. For large images it is a poor trade because the one third size increase adds up fast.

Email attachments and MIME

Email was originally designed to carry plain text only. When you attach a photo or a PDF, your mail client uses a standard called MIME, and under the hood it Base64 encodes the attachment so the binary file survives the trip through mail servers that expect text. This is the original problem Base64 was invented to solve, and it still runs in every email attachment you send today.

Data in URLs, JSON, and JWTs

URLs and JSON are text formats, so dropping raw binary into them is asking for trouble. Base64 lets you tuck binary values into a query string, a token, or a JSON field as clean text. A variant called Base64url swaps + and / for - and _, because plus and slash have special meaning inside URLs. JSON Web Tokens (JWTs), which authenticate users across the web, are built from Base64url encoded pieces.

HTTP basic authentication

When a system uses HTTP basic authentication, it joins the username and password with a colon and Base64 encodes the result into the Authorization header. Wikipedia's worked example shows Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== decodes straight back to Aladdin:open sesame. That header looks scrambled but offers no real protection, which is exactly why the next section matters.

Why isn't Base64 the same as encryption?

This is the single most misunderstood thing about Base64, so it is worth stating plainly. Base64 is encoding, not encryption. It provides no security, no privacy, and no protection whatsoever.

Encryption uses a secret key, and without that key the data is unreadable. Base64 uses a fixed, public scheme with no key at all. Anyone who sees a Base64 string can decode it in a fraction of a second using any free tool. So if you ever feel tempted to Base64 encode a password, an API key, or private data to keep it safe, don't. It is the equivalent of writing a secret in a slightly different alphabet that everyone already knows how to read.

Does Base64 make files bigger?

Yes, and by a predictable amount. Because every 3 bytes become 4 characters, Base64 output runs about 33 percent larger than the raw binary. Base64.sh puts it in plain numbers: a 1 MB image becomes roughly 1.37 MB of Base64 text, and a 12 KB PNG becomes about a 16 KB data URI once you add the data:image/png;base64, prefix.

That overhead is the whole reason Base64 is great for tiny assets and bad for big ones. Inline a 2KB icon and nobody notices the extra few hundred bytes. Inline a 2MB hero image and you have bloated your HTML by around 660KB and blocked the browser from caching it separately. If you plan to embed images, compress or resize them first with the free editors at IWantFreeImageTools.com so the encoded output stays small.

How do you encode and decode Base64 for free?

You do not need to install anything or write code to work with Base64. The fastest way is a browser based tool. To encode, you paste your text or upload a file, and the tool returns the Base64 string. To decode, you paste the Base64 string and get the original text or file back.

Because Base64 is a fixed, deterministic mapping, encoding and decoding always produce the same result, so a good tool just does the conversion instantly. The important quality to look for is that the work happens locally in your browser rather than on a remote server, so your data is never uploaded. If you work with URLs a lot, our URL encoder handles the related job of percent-encoding text for query strings, and the free developer tools guide rounds up the rest.

What do people ask about Base64?

What is Base64 encoding used for?

Base64 converts binary data into plain text so it can travel safely through systems that only handle text. Common uses include embedding images in HTML or CSS as data URIs, sending file attachments in email through MIME, putting binary values inside URLs or JSON, and encoding credentials in HTTP basic authentication headers.

Is Base64 encryption?

No. Base64 is encoding, not encryption. It uses a fixed, public scheme with no secret key, so anyone can decode it instantly. It provides zero security or confidentiality. Never use Base64 to hide passwords or sensitive data. Use real encryption like AES or TLS for that.

How do you decode a Base64 string?

Paste the Base64 text into a free online Base64 decoder and it returns the original text or file. The process is fully reversible because Base64 is a deterministic mapping. Our free Base64 encoder and decoder runs entirely in your browser, so your data is never uploaded anywhere.

Does Base64 increase file size?

Yes. Base64 turns every 3 bytes into 4 characters, so the output is about 33 percent larger than the original. A 1 MB image becomes roughly 1.37 MB of Base64 text. That overhead is why Base64 suits small icons and inline snippets but not large files.

What is the difference between Base64 and Base64url?

Base64url is a URL-safe variant defined in RFC 4648. It swaps the two characters that break in URLs, replacing plus with hyphen and slash with underscore, and often drops the equals padding. JSON Web Tokens and OAuth values use Base64url so they can sit safely inside a URL.