What is Base64? Encoding Explained

How Base64 encoding works

Base64 takes the input three bytes (24 bits) at a time and splits them into four groups of six bits. Each six-bit value (0–63) is mapped to one character of the alphabet. Three bytes in, four characters out — which is why Base64 output is always about 33% larger than the input.

When the input length is not a multiple of three, the last group is padded with zero bits and one or two "=" characters are appended so the decoder knows how many real bytes to expect.

Text:   Hi!
Bytes:  01001000 01101001 00100001
Groups: 010010 000110 100100 100001
Index:  18     6      36     33
Base64: S      G      k      h        → "SGkh"

Text:   Hi      (2 bytes → one "=" of padding)
Base64: SGk=

Try it: Base64 Encoder Try it: Binary Encoder / Decoder

Base64 is not encryption

Anyone can decode Base64 instantly with no key — it is a reversible encoding, like writing a number in hexadecimal. It hides nothing. A password, API key or token that is "protected" with Base64 is exposed to anyone who sees it. Use real encryption (AES, TLS) to protect data and Base64 only to transport it.

Try it: Base64 Decoder

When to use Base64

• Embedding small images or fonts in HTML, CSS or JSON as data: URIs.
• Sending binary content inside a JSON or XML payload, which can only hold text.
• HTTP Basic authentication: the header carries Base64 of "username:password" (transport only — always over HTTPS).
• JWT and other tokens, which use the URL-safe variant for their header, payload and signature.
• Email attachments (MIME) and any legacy protocol that expects 7-bit text.
• Not for large files where a binary channel exists — the 33% overhead and the extra encoding step are pure waste.

Base64 vs Base64URL

Standard Base64 uses "+" and "/", both of which have special meaning in URLs, and "=" padding, which is often percent-encoded. Base64URL (RFC 4648 §5) swaps them for "-" and "_" and usually drops the padding, so the result can be used in a URL, a file name or a JWT without further escaping. A decoder that expects one variant will reject the other, which is the most common reason a "valid" token fails to decode.

Try it: URL Encoder Try it: JWT Decoder

Encoding text: watch the character set

Base64 encodes bytes, not characters, so text must be turned into bytes first — almost always UTF-8. Arabic, Hindi and emoji become multi-byte sequences; if the encoder uses UTF-8 and the decoder assumes Latin-1 (or the reverse) the output is mojibake. When two systems disagree about a Base64 string, the character set is the first thing to check.

Try it: Base64 Encoder Try it: Hex Encoder

Why decoding fails

• Wrong alphabet — a Base64URL string ("-", "_") fed to a standard decoder, or vice versa.
• Missing or extra padding — some encoders omit "=", and strict decoders require a length that is a multiple of four.
• Whitespace or line breaks inside the string — MIME wraps lines at 76 characters; strip them before decoding.
• Double encoding — a string that was Base64-encoded twice looks valid but decodes to more Base64.
• It was never Base64 — hex, a hash or a random token can look similar. Base64 uses exactly the 64 characters plus "=", and its length is a multiple of four when padded.

Try it: Base64 Decoder

Frequently asked questions