🔐 What Is Base64 Encoding and When to Use It

If you've ever spotted a strange string made only of letters, digits, +, /, and = in a config file or API response, it's almost certainly Base64. This guide explains exactly what Base64 does, why it's used, and why it can never serve as a security measure.

What Base64 actually does — binary into text

Base64 converts arbitrary binary data into plain ASCII text so it can travel unbroken through systems that only safely handle text — email, JSON, URLs. As the name suggests, it represents data using just 64 characters (A-Z, a-z, 0-9, +, /). The mechanism is simple: source bytes are grouped 3 at a time (24 bits), split into four 6-bit chunks, and each 6-bit value (0–63) is mapped to one character from that 64-character table. That's why "3 bytes become 4 characters," and why encoded output ends up roughly 33% larger than the original. When the final group doesn't fill a full 3 bytes, the leftover space is padded with = characters.

A real encoding example

The text Man is exactly 3 bytes (M=77, a=97, n=110), so it encodes cleanly to 4 characters: TWFu. Hello, on the other hand, is 5 bytes — it doesn't divide evenly into groups of 3 — and encodes to SGVsbG8=. That trailing = is padding for the incomplete final group. Decoding simply reverses the process, turning each group of 4 characters back into 3 bytes.

Why it's used — text-only pipes

Base64 is widespread because a lot of internet infrastructure was originally designed to carry text only:

• Email attachments (MIME) — SMTP was designed around 7-bit text and can't carry binary files like images or documents directly, so they're Base64-encoded and embedded in the message body.
• Data URIs — used to embed an image directly inside HTML or CSS without a separate file, e.g. data:image/png;base64,iVBORw0KG....
• JWT (JSON Web Token) — the header and payload are represented with Base64URL (a URL-safe variant of standard Base64) so they can be embedded directly in a URL-safe string.
• API auth headers — HTTP Basic Authentication's Authorization: Basic ... value is just username:password run through Base64.

Base64 is not encryption

This is the single most important thing to remember. Base64 only changes how data is represented — it requires no key and no secret. Anyone holding the encoded string can restore the original instantly, with nothing more than a one-line snippet in a browser console. So wrapping a password, API key, or personal data in Base64 does not "hide" it — don't mistake it for protection. If a value genuinely needs to stay confidential, you need real encryption (like AES) or, better, a design that avoids transmitting or storing the value at all. Base64 exists purely to move binary data safely through text-only pipes — nothing more.

Want to encode text into Base64 or find out what an unfamiliar Base64 string actually contains? You can do that instantly with our free tool.

Base64 alphabet (64 indices)

Base64 maps each 6-bit value (0–63) to one of the 64 characters below, encoding 3 bytes (24 bits) as 4 characters.

Standard Base64 vs Base64URL

+, /, and = are special characters in URLs, so URLs and JWTs use Base64URL, which replaces them with - and _ and omits padding.

More guides