If you've ever looked at an email source, a JWT token, or a data URL for an image, you've seen Base64. It looks like scrambled text: a long string of letters, numbers, and the occasional +, /, and =. Understanding what Base64 is and why it exists makes a lot of things in web development and data exchange much clearer.
What is Base64?
Base64 is a way of encoding binary data (like images, files, or arbitrary bytes) into a string of printable ASCII characters. The name comes from the fact that it uses an alphabet of 64 characters: the 26 uppercase letters, the 26 lowercase letters, the digits 0–9, plus + and /. A = character is used for padding.
The key point: Base64 is encoding, not encryption. It doesn't hide data or add security. Anyone who sees a Base64 string can decode it instantly. It's purely a format conversion, turning raw bytes into a string that's safe to transmit in contexts that only handle text.
Why does Base64 exist?
Most communication protocols were designed around plain text. Email (SMTP), HTTP headers, URLs, and HTML all expect ASCII or UTF-8 text. Binary data — images, audio, compiled code — can contain any byte value, including bytes that have special meaning or that break text-only systems.
Base64 was invented to solve this: convert binary data into a predictable, text-safe format that travels through text-only systems without corruption.
How Base64 encoding works
Base64 works by taking 3 bytes of input (24 bits) at a time and converting them into 4 Base64 characters (each representing 6 bits).
For example:
- The word
Manin ASCII is the bytes77 97 110(binary:01001101 01100001 01101110) - Group those 24 bits into four 6-bit chunks:
010011 010110 000101 101110 - Each chunk maps to a character in the Base64 alphabet:
T W F u - Result:
TWFu
If the input isn't a multiple of 3 bytes, padding (= or ==) is added to complete the final group.
This means Base64 output is always about 33% larger than the original. Three bytes become four characters.
Where Base64 is used
Email attachments
The SMTP protocol was designed for plain text. When you attach a file to an email, your email client encodes it as Base64 and embeds it in the message body. The recipient's client decodes it back. This is why email can carry any file type.
Data URLs
You can embed an image directly in HTML or CSS without a separate file request, by Base64-encoding it and putting it in a data: URL:
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..." />
This is useful for small icons or critical images where you want to avoid an extra HTTP request.
JWT tokens
JSON Web Tokens (JWTs) use Base64url encoding (a URL-safe variant of Base64 that uses - and _ instead of + and /) for their header and payload. The token looks like eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U. Each dot-separated section is Base64url-encoded JSON (or a signature).
API responses and binary data in JSON
JSON only carries text. When an API needs to return binary data (a PDF, an image thumbnail, an encrypted blob), it often encodes it as Base64 and wraps it in a JSON string field.
Basic authentication in HTTP
HTTP Basic Auth encodes username:password as Base64 and sends it in the Authorization header. Again, this is not security — anyone who intercepts the header can decode it. HTTPS provides the actual security layer.
Base64url: the URL-safe variant
Standard Base64 uses + and /, both of which have special meaning in URLs. Base64url replaces them with - and _, and omits the padding =, making the output safe to put directly in a URL without percent-encoding. JWTs and many modern APIs use Base64url.
Common misconceptions
"Base64 is encryption"
It is not. Base64 provides zero security. It's a representation change, not a transformation that hides meaning. Never use Base64 to protect sensitive data. Use real encryption (AES, RSA, etc.) if you need confidentiality.
"Decoding Base64 requires a special tool"
Any programming language can decode Base64 in one line. In JavaScript: atob(str). In Python: base64.b64decode(str). In the terminal: echo "SGVsbG8=" | base64 -d. It's trivial.
"Base64 compresses data"
It does the opposite. Base64 output is 33% larger than the input. It's a format conversion, not compression.
How to encode or decode Base64 in your browser
You don't need to install anything or write code. Toolmingo's Base64 Encoder/Decoder lets you:
- Paste text and get Base64 output instantly
- Paste a Base64 string and decode it back to text
- Everything runs in your browser — nothing is sent to a server
If you want to encode an image as a Base64 data URL, use the Image to Base64 tool instead.
FAQ
Q: Is Base64 the same as hexadecimal encoding? Both convert binary data to text, but they use different alphabets. Hex uses 16 characters (0–9 and a–f), so each byte becomes two hex characters. Base64 uses 64 characters and packs more bits per character, making it more compact. Base64 output is about 33% larger than the input; hex output is 100% larger (double the size).
Q: How do I tell if a string is Base64?
Look for the character set: letters (upper and lower), digits, + and /, with optional = padding at the end. A Base64 string's length is always a multiple of 4 (when padded). You can try decoding it — if it produces readable output or a valid file, it was probably Base64.
Q: Should I use Base64 to store passwords? Never. Base64 is instantly reversible, so Base64-encoded passwords offer zero protection. Use a proper password hashing algorithm: bcrypt, argon2, or scrypt.
Q: What's the difference between Base64 and Base58?
Base58 drops characters that look similar in many fonts (0, O, I, l) and the + and / characters, making it human-readable and safe to type. Bitcoin addresses and many short URL systems use Base58. Base64 is more common in technical contexts because it's a standard.