What Is Base64? How It Works and When to Use It
A clear explanation of Base64 encoding, why it exists, how it differs from encryption, and practical uses with images and text.
The problem Base64 solves
Many older systems, such as email protocols, were designed to carry plain text, and can corrupt or reject arbitrary binary data like images or files. Some formats, like JSON and XML, also cannot contain raw bytes. Base64 solves this by representing any data using only 64 safe characters: the letters A–Z and a–z, the digits 0–9, plus + and /, with = used for padding.
How it works
Base64 takes the input three bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which maps to one of the 64 characters. Three bytes become four characters, so the output is about 33 percent larger than the input. If the input length is not a multiple of three, one or two = signs are added as padding. For example, the text Man encodes to TWFu.
It is not encryption
Base64 is an encoding, not a code with a key. Anyone can decode it instantly, with no password. It hides nothing. If you see credentials in an HTTP header written in Base64, they are effectively in plain text, which is why those must travel only over HTTPS. Never use Base64 to 'protect' a password or secret. If you need confidentiality, use real encryption.
Common uses
Data URLs: small images can be embedded directly in HTML or CSS as data:image/png;base64,..., saving a network request. The Image to Base64 tool creates these. It is worth it for tiny icons, but large images become bulky and cannot be cached separately, so use normal files for those.
Email attachments: the MIME standard uses Base64 to carry attachments inside text-based messages. APIs and tokens: JSON Web Tokens use a URL-safe Base64 variant, replacing + and / with - and _, so they can sit safely in URLs. Configuration files: certificates and keys are often stored as Base64 text in PEM files.
Text and character sets
Base64 works on bytes, not letters, so non-English text needs a consistent character encoding first. The Base64 Encoder / Decoder tool converts text to UTF-8 bytes before encoding, which means accented letters and many scripts round-trip correctly. If a decode produces garbled characters, the original was probably encoded using a different character set.
Troubleshooting
If decoding fails, check for missing or extra characters, stray spaces, or line breaks inserted by an email program. A string using - and _ is URL-safe Base64 and needs those swapped back to + and / before standard decoding. Note too that Base64 is different from percent-encoding, which makes text safe inside a web address; use the URL Encoder / Decoder for that.
Variants you may meet
Standard Base64 (RFC 4648) uses A–Z, a–z, 0–9, + and /, with = padding. URL-safe Base64 swaps + and / for - and _, and often omits the padding, so the text can go in a web address or file name without encoding. MIME Base64, used in email, breaks the text into lines of at most 76 characters. If decoding fails, identify which variant you have before anything else.
Performance and safety considerations
Embedding large files as Base64 makes pages heavy, because the encoded text is about a third larger than the file, cannot be cached on its own and delays rendering. Reserve it for tiny assets.
Treat decoded data as untrusted. A Base64 string from an unknown source might hide a script or a file with a misleading type. Never run or open decoded content just because it decoded successfully. And remember again that Base64 hides nothing: do not put secrets into it expecting protection.
Quick reference
Three bytes in, four characters out. The alphabet has 64 symbols, which is 6 bits each. A string ending with == had one byte left over, one ending with a single = had two. Text 'Hello' encodes to SGVsbG8=. Use the Base64 Encoder / Decoder tool to try your own strings, and the Image to Base64 tool for small images.