What Base64 is and when to use it
Base64 is a way to write arbitrary bytes using only 64 safe, printable characters: A-Z, a-z, 0-9, + and /. It exists because many systems (email, JSON, URLs, HTTP headers) were built for text and break on raw binary. You can try it in the Base64 encoder and decoder.
How it works
The input is read three bytes (24 bits) at a time and split into four groups of 6 bits. Each 6-bit value, 0 to 63, maps to one character in the alphabet. If the input length is not a multiple of three, = padding fills out the last group. For example, the text Man becomes TWFu.
Why the output is bigger
Three bytes become four characters, so Base64 output is about one third larger than the input. A 300 KB image embedded as Base64 costs roughly 400 KB.
It is not encryption
Anyone can decode Base64 without a key. Putting a password or token in Base64 hides nothing. If data must be secret, encrypt it first; Base64 is then only the way you carry the encrypted bytes as text.
Common uses
- Data URIs: small images inlined in HTML or CSS as
data:image/png;base64,.... - Email attachments: MIME encodes binary files this way.
- HTTP Basic authentication: the
user:passwordpair is Base64-encoded in the header, which is why Basic auth must only be used over HTTPS. - JWTs: the header and payload are Base64URL-encoded JSON.
The URL-safe variant
+ and / have special meaning in URLs and filenames. Base64URL (RFC 4648, section 5) swaps them for - and _ and usually omits the = padding. Use the URL-safe option in the tool when the result goes into a URL, a filename or a JWT.
Text and Unicode
Base64 works on bytes, not characters, so text must be turned into bytes first. UTF-8 is the usual choice. Encoding text with accents or emoji through a function that assumes single-byte characters produces wrong output, which is why the tool encodes as UTF-8.