Base64 Guide: What It Is and How to Encode and Decode

Base64 is a way to write binary data as ordinary text. A PDF, an image or a block of bytes cannot be dropped into an email body, a JSON field or a URL, because those channels allow only a limited set of characters. Base64 maps the binary onto a 64-character alphabet that survives every text channel, at the cost of making the data about a third longer. The base64 encoding rules are defined in RFC 4648, which this guide follows.

What is base64?

Base64 is a binary-to-text encoding that represents every 6 bits of input as one character from a fixed 64-character set: the uppercase and lowercase letters, the digits, and the two extra characters plus and slash. The name comes from those 64 symbols. Because 6 bits fit in a byte with room to spare, the output is made only of the safe characters and no raw bytes leak through. It is the same family as hex, which uses 16 symbols, but denser.

How does base64 work?

The encoder reads the input three bytes at a time, which is 24 bits, and splits those bits into four groups of six. Each six-bit group selects one of the 64 alphabet characters. When fewer than three bytes remain, the final group is padded. A worked example: the three bytes of cat encode to the four characters shown below, and a single byte encodes to two characters plus two padding signs.

input:   c        a        t
bytes:   01100011 01100001 01110100
bits:    011000 110110 000101 110100
chars:   Y       W       F      0

"cat" -> "YWF0"

What does the padding equals sign mean?

Every four output characters normally come from three input bytes. If the input length is not a multiple of three, the last group is incomplete, and base64 adds one or two equals signs to reach a multiple of four characters. Decoders use the padding to know how many bytes the final group holds. Stripping it produces valid output too - many systems do - but the padded form is the standard and is what most tools emit and expect.

Why does base64 add a third more data?

The math is a ratio of four to three. Three bytes of 8 bits become four characters of 6 bits, so the output length is the input length times 4 over 3, rounded up and padded. That is where the 33 percent overhead comes from, and it is unavoidable for an alphabet of 64 characters. If the overhead matters, options are to compress before encoding, or to keep the data binary and skip base64 entirely at the transport level.

When should you use base64?

• Email attachments, where the MIME standard wraps binary in base64 so the body stays printable.
• Data URLs, such as data:image/png;base64,... which embed a small image directly in HTML or CSS.
• Binary inside JSON, because a JSON string cannot hold raw bytes but can hold base64 text.
• The basic auth header, where the username and password pair is joined and base64 encoded.

The common thread is a text-only boundary. Wherever the medium insists on characters, base64 is the standard bridge. Where the medium accepts bytes, sending raw bytes is smaller and faster.

Is base64 encryption?

No, and treating it as one is a common and costly mistake. Encoding is reversible by definition and needs no key, so base64 hides a value from a casual glance at best, and it is trivially decoded by anyone. Data that must stay secret needs encryption, and data whose integrity must be checked needs a hash; base64 does neither. The difference is covered in detail in the hash vs encryption guide.

What is base64url?

Standard base64 uses plus and slash, which have meanings inside URLs and filenames. Base64url, the variant used by JWT and many web APIs, replaces plus with a hyphen and slash with an underscore, and usually omits the padding. The output then needs no percent-escaping and can sit directly in a URL segment. The two forms encode the same underlying data; only the alphabet and padding differ.

How do you encode and decode?

The Base64 Encode and Decode tool handles both directions in the browser, with an option for the URL-safe alphabet. In code it is two calls in any language:

// JavaScript - browser and Node both expose these
btoa('hello')              // "aGVsbG8="
atob('aGVsbG8=')           // "hello"

# Python
import base64
base64.b64encode(b'hello')  # b'aGVsbG8='
base64.b64decode(b'aGVsbG8=')  # b'hello'

A few checks keep results clean: decode the padding exactly as it appears, be aware that whitespace can creep into pasted values, and decide deliberately between the standard and the URL-safe alphabet. When a token such as a JWT shows a base64-looking middle segment, the header and payload decode with the URL-safe variant.