What Is Base64 Encoding? A Plain-English Guide (With Examples)

If you have ever seen a chunk of text like SGVsbG8sIFdvcmxkIQ== in an API response, an email attachment, or a browser data: URL, you have run into Base64. It looks like gibberish, but it is one of the most common encoding schemes on the internet, and understanding it takes about five minutes.

What Base64 Actually Does

Base64 takes binary data, anything from an image file to a JSON string, and represents it using only 64 printable ASCII characters: A-Z, a-z, 0-9, plus + and /. Because computers can trust that these characters will not get mangled by email systems, old text protocols, or URL parsers, Base64 became the standard way to move binary data through systems that were only ever built for text.

The trade-off is size. Every 3 bytes of original data becomes 4 Base64 characters, so encoded output is roughly 33% larger than the original. That is the price for guaranteed safe transport.

Where You’ll Actually Run Into It

• Data URLs — images embedded directly inside HTML or CSS instead of a separate file request
• Email attachments — the MIME standard encodes binary files as Base64 so they survive old text-only mail servers
• JWT tokens — JSON Web Tokens are three Base64url-encoded segments separated by dots
• API payloads — sending binary data such as a file upload inside a JSON request often means Base64-encoding it first
• HTTP Basic Auth — the Authorization header encodes “username:password” as Base64, which is not secure on its own
• Cookies — some apps Base64-encode structured data before storing it in a cookie

Base64 Is Not Encryption

This is the single most important thing to understand about Base64, and the most common mistake people make with it. Base64 is an encoding, not encryption. It has no key, no secret, and no security purpose whatsoever. Anyone can decode a Base64 string in seconds using a free browser tool. If you see a password or token that has just been Base64-encoded, treat it as plain text, because for all practical purposes it is.

Reading the Padding: Why Some Base64 Ends in =

Base64 works in blocks of 3 bytes in, 4 characters out. When your input isn’t a clean multiple of 3 bytes, the encoder pads the final block with = characters so the output still lines up to a multiple of 4. One = means the input was short by 1 byte, two == means it was short by 2. If Base64 you’re working with doesn’t decode properly, missing or extra padding is usually the first thing to check.

Base64 vs Base64url

Standard Base64 uses + and / in its alphabet, and both characters have special meaning inside a URL. Base64url swaps + for – and / for _, and often drops the trailing = padding entirely, so the result can be dropped straight into a URL or filename without escaping. JWTs, for example, always use Base64url rather than standard Base64.

Frequently Asked Questions

Is Base64 safe to use for passwords?

No. Base64 provides zero security. Use proper hashing, like bcrypt, for stored passwords, and encryption, like TLS, for data in transit. Base64 is only for making binary data safely transportable as text.

Why does my Base64 string look different in a URL?

You are probably looking at Base64url, which replaces + and / with – and _ so the string doesn’t need to be escaped inside a URL. Decoding it correctly requires knowing which variant was used.

Can I encode an entire file to Base64?

Yes. Any file type, including images, PDFs, and executables, can be Base64-encoded. The output is larger than the original file by about a third, so it is normally used for smaller files or where convenience matters more than size.

Does Base64 work the same in every programming language?

The core algorithm is standardized under RFC 4648, but some languages default to standard Base64 and others to Base64url, and line-wrapping behavior varies. When decoding fails unexpectedly across systems, this mismatch is a common culprit.

Need to encode or decode Base64 right now? The Base64 Encoder / Decoder tool runs entirely in your browser, nothing is uploaded anywhere, and it supports both plain text and files.