Encoders / Decoders6 min read
Base64 is everywhere — in data URIs, email attachments, JSON payloads, and API tokens — yet it is widely misunderstood, especially the belief that it provides some security. This guide explains exactly what Base64 is, how the encoding works byte by byte, why the output grows by about a third, and the crucial point that it is encoding, not encryption. You can try any example in the Base64 Encoder.
What Base64 is for
Base64 is a binary-to-text encoding: it represents arbitrary binary data using only 64 printable ASCII characters. Its purpose is to move binary data safely through channels that were built for text — embedding an image in a stylesheet, attaching a file to an email, or putting a byte string inside a JSON field — without the bytes being corrupted or misinterpreted.
How the encoding works
Base64 processes input three bytes at a time. Three bytes are 24 bits, which split neatly into four groups of six bits. Each 6-bit group is a number from 0 to 63, and that number maps to one character in the Base64 alphabet. That is why three bytes of input always become four characters of output.
Input bytes: M a n ASCII: 77 97 110 Binary: 01001101 01100001 01101110 Regrouped(6): 010011 010110 000101 101110 Values: 19 22 5 46 Base64: T W F u -> "TWFu"
Padding and length
When the input length is not a multiple of three, the final group is padded with '=' characters so the output length is always a multiple of four. One leftover byte produces two Base64 characters plus '==', and two leftover bytes produce three characters plus a single '='. The padding tells a decoder how many real bytes the final block represents.
| Input | Base64 |
|---|---|
| Man (3 bytes) | TWFu |
| Ma (2 bytes) | TWE= |
| M (1 byte) | TQ== |
Why output is about 33% larger
Every 3 bytes become 4 characters, so the encoded form carries the same information in four-thirds the size — roughly a 33% increase, before counting padding. This overhead is the price of text-safety, which is why Base64 is used for transport and embedding rather than for storage or compression.
URL-safe Base64
Standard Base64 uses + and /, which have special meaning in URLs and filenames. The URL-safe variant replaces + with - and / with _ so the encoded string can be dropped into a URL or filename without extra escaping. The rest of the alphabet is identical, and JSON Web Tokens use this variant.
Base64 is not encryption
This is the most important point: Base64 provides no security at all. Anyone can decode a Base64 string back to its original value instantly, with no key. Never use it to hide passwords, tokens, or secrets. For confidentiality use real encryption such as AES; for integrity use a hash or signature.
Frequently asked questions
Is Base64 encryption?+
No. It is a reversible encoding that anyone can decode without a key. It offers no confidentiality and must never be used to protect secrets.
Why does Base64 increase the size of data?+
It encodes every 3 bytes as 4 ASCII characters, a four-thirds ratio, so the output is about 33% larger than the input.
What are the '=' signs at the end of Base64?+
They are padding added when the input length is not a multiple of three, so the output length is always a multiple of four. They tell the decoder how many bytes the final block holds.
What is URL-safe Base64?+
A variant that replaces + with - and / with _ so the string is safe in URLs and filenames. It is used by JSON Web Tokens, among others.
Can Base64 encode any file?+
Yes. Because it works on raw bytes, it can encode any binary data — images, fonts, PDFs — which is how data URIs embed files directly in HTML and CSS.