What is Base64?
Base64 is a way to write any binary data — an image, a PDF, an encryption key — using only 64 “safe” characters: A–Z, a–z, 0–9, + and /, with = as padding. Because the result is plain ASCII text, it can travel through systems that were designed for text only: email, JSON, XML, HTML, URLs and HTTP headers.
Base64 is encoding, not encryption. Anyone can decode it, so it does not protect secrets. It simply makes data transportable. The format is defined in RFC 4648; e-mail (MIME) uses the same alphabet with line breaks every 76 characters (RFC 2045).
How Base64 encoding works
The encoder takes 3 bytes (24 bits) at a time, splits them into four groups of 6 bits and maps each group (0–63) to one character of the alphabet. Here is the word “Man”:
| Step | 1 | 2 | 3 | 4 |
|---|---|---|---|---|
| Text | M | a | n | |
| Byte value | 77 | 97 | 110 | |
| Bits (8 per byte) | 01001101 | 01100001 | 01101110 | |
| Bits (6 per character) | 010011 | 010110 | 000101 | 101110 |
| Index (0–63) | 19 | 22 | 5 | 46 |
| Base64 | T | W | F | u |
So “Man” becomes TWFu. When the input length is not a multiple of three, the last group is filled with zero bits and one or two = signs are added: “Ma” → TWE=, “M” → TQ==.
Base64 variants
| Variant | Characters / rule | Used in |
|---|---|---|
| Standard (RFC 4648 §4) | A–Z a–z 0–9 + / and = | JSON APIs, XML, databases, most programming languages |
| URL-safe (Base64URL, §5) | A–Z a–z 0–9 - _ usually without = | JWT tokens, URLs, file names, OAuth, WebAuthn |
| MIME (RFC 2045) | Standard, max 76 characters per line, CRLF | E-mail attachments (SMTP), S/MIME |
| PEM (RFC 7468) | Standard, 64 characters per line + BEGIN/END lines | TLS certificates, SSH and PGP keys |
| Data URI (RFC 2397) | data:[type];base64,[data] | Images and fonts embedded in HTML, CSS, SVG, e-mail |
Common uses
- Embedding images in HTML, CSS or e-mails as Data URIs to save an HTTP request (best for small icons under ~10 KB).
- Sending files through JSON or XML APIs — e.g. uploading a document or a signature image in a REST request.
- Reading JWT tokens: the header and payload are Base64URL-encoded JSON. Paste one part here to read it.
- HTTP Basic authentication: the
Authorizationheader containsuser:passwordin Base64. - Certificates and keys (PEM files), Kubernetes secrets and many configuration values are stored as Base64.
How much bigger does Base64 make data?
Base64 output is always about 33% larger than the input: every 3 bytes become 4 characters. The exact length is 4 × ⌈n / 3⌉ characters (without line breaks). With MIME line breaks it is about 37% larger.
| Original | Base64 | With MIME line breaks |
|---|---|---|
| 1 KB (1,024 bytes) | 1,368 characters | ≈ 1.4 KB |
| 100 KB | ≈ 133 KB | ≈ 137 KB |
| 1 MB | ≈ 1.33 MB | ≈ 1.37 MB |
| 10 MB | ≈ 13.3 MB | ≈ 13.7 MB |
Is Base64 secure?
No — Base64 hides nothing. Never use it to “protect” passwords or personal data; use real encryption (for example AES or TLS) instead. What is safe is this tool: your data is encoded and decoded locally in your browser and is never uploaded, which matters when you work with tokens, keys or customer files.
Base64 in code
Tip: in JavaScript, btoa() only accepts Latin-1 and fails on emoji or “€” — convert the text to UTF-8 bytes first, as shown below.
| Language | Encode | Decode |
|---|---|---|
| JavaScript | btoa(String.fromCharCode(...new TextEncoder().encode(s))) | new TextDecoder().decode(Uint8Array.from(atob(b), c => c.charCodeAt(0))) |
| Node.js | Buffer.from(s, 'utf8').toString('base64') | Buffer.from(b, 'base64').toString('utf8') |
| Python | base64.b64encode(s.encode()).decode() | base64.b64decode(b).decode() |
| PHP | base64_encode($s) | base64_decode($b, true) |
| Java | Base64.getEncoder().encodeToString(bytes) | Base64.getDecoder().decode(b) |
| C# | Convert.ToBase64String(bytes) | Convert.FromBase64String(b) |
| Go | base64.StdEncoding.EncodeToString(data) | base64.StdEncoding.DecodeString(b) |
| Linux / macOS | base64 -w 0 file.bin | base64 -d file.txt > file.bin |
| PowerShell | [Convert]::ToBase64String([IO.File]::ReadAllBytes("f.bin")) | [IO.File]::WriteAllBytes("f.bin", [Convert]::FromBase64String($b)) |
Tips
- Keyboard: Ctrl+Enter converts, Ctrl+Shift+Enter swaps input and result, Ctrl+S downloads (⌘ on Mac).
- Garbled accents after decoding (e.g. “é” instead of “é”)? The data was probably created with another charset — choose Windows-1252 or ISO-8859-1 in the Charset menu.
- JWT: paste only the middle part (between the two dots) and decode — the tool understands the URL-safe alphabet and missing padding automatically.
- Screenshots: press Ctrl+V anywhere on the page to turn a copied image into a Data URI.
- Large images make HTML and CSS heavy. For anything above a few kilobytes, a normal image file (compressed with our Image Compressor) loads faster.