What is Base64, and when should you use it?

How Base64 turns any data into plain text, why it makes things a third bigger, where it is used — data URIs, email, tokens — and why it is not encryption.

Published 2 October 2026

Tools for this job: Base64 Encoder · Base64 Decoder · URL Encoder

You meet Base64 as long strings of letters and numbers ending in one or two equals signs: in email source, inside web pages, in API responses and login tokens. It looks like gibberish, but it is a simple and completely reversible way of writing data as text.

What problem it solves

Many systems were built to carry text, not arbitrary bytes. Email, JSON, URLs and HTTP headers can mangle binary data such as an image or a file. Base64 rewrites any data using only 64 safe characters — A to Z, a to z, 0 to 9, plus and slash — so it survives the journey intact and can be turned back into the original bytes at the other end.

How it works

Base64 takes three bytes at a time — 24 bits — and splits them into four groups of six bits. Each group is a number from 0 to 63, written as one of the 64 characters. When the data does not divide evenly into threes, one or two equals signs pad the end.

“Man” becomes TWFu.
“Hi” becomes SGk= — one padding sign.
“café” becomes Y2Fmw6k=, because é is two bytes in UTF-8.

Why Base64 is a third bigger

Every three bytes become four characters, so encoded data is about 33% larger than the original. That is the price of making it text-safe, and it is why embedding large files as Base64 is usually a poor idea.

Base64 is not encryption

There is no key and no secret. Anyone who has a Base64 string can decode it in a second. A password, token or personal detail “hidden” in Base64 is not hidden at all. Use real encryption to protect data; use Base64 only to transport it.

Encode and decode step by step

Paste text or drop in a file in the Base64 Encoder.
Choose standard or URL-safe output, and optionally a complete data URI for a file.
Copy the result.

To reverse it, paste into the Base64 Decoder. If the result is text, it is shown; if it is a file, the type is recognised from its first bytes and you can download it. Text is converted to UTF-8 bytes first, so accented letters and emoji work. Everything runs in your browser.

URL-safe Base64

Plus and slash have special meanings in web addresses, so a URL-safe variant swaps them for minus and underscore and usually drops the padding. Use it for values that go into URLs, file names and tokens. The decoder accepts both forms. For ordinary text in URLs, percent-encoding is the right tool instead — see the URL Encoder.

Where you will meet Base64

Data URIs such as data:image/png;base64,…, which embed a small image directly in HTML or CSS, saving a request at the cost of a bigger page.
Email attachments, which are Base64-encoded behind the scenes — one reason a file grows when emailed.
JSON Web Tokens, whose three dot-separated parts are Base64url. Decoding the middle part shows what a token claims; it does not prove the token is genuine.
Basic authentication headers, where a username and password are Base64-encoded — readable by anyone who sees them, which is why they must only travel over HTTPS.