Base64 in one sentence
Base64 is a binary-to-text encoding defined in RFC 4648 that represents every 3 bytes of data as 4 characters from the alphabet A–Z, a–z, 0–9, + and /.
Why Base64 exists
Many systems were designed for text only: email (SMTP), JSON, XML, HTML attributes, URLs and terminals. Raw binary data such as images or PDFs can contain bytes that these systems would change or reject. Base64 converts the data into safe, printable characters so it survives the trip unchanged.
How Base64 encoding works, step by step
- Take the input bytes:
M,a,n= 77, 97, 110. - Write them as 24 bits:
01001101 01100001 01101110. - Split the bits into four 6-bit groups:
010011 010110 000101 101110= 19, 22, 5, 46. - Look up each number in the alphabet: 19 =
T, 22 =W, 5 =F, 46 =u.
So Man becomes TWFu. Decoding simply reverses these steps.
The Base64 alphabet
| Values | Characters |
|---|---|
| 0–25 | A–Z |
| 26–51 | a–z |
| 52–61 | 0–9 |
| 62 | + (URL-safe: -) |
| 63 | / (URL-safe: _) |
| padding | = |
What the = padding means
When the input length is not a multiple of 3, the last group is filled up and marked with =: Ma becomes TWE= and M becomes TQ==. Padding never appears in the middle of a valid string.
Base64 variants
- Standard Base64 (RFC 4648) – the alphabet above with
=padding. - Base64URL – uses
-and_and often no padding; used in URLs, file names and JWTs. - MIME Base64 – standard alphabet with line breaks every 76 characters, used in email.
Base64 is not encryption
Base64 hides nothing: anyone can decode it instantly. It is often mistaken for protection because the output looks random. Use real encryption such as AES for secrets, and Base64 only to transport the encrypted bytes as text.
Size overhead
The encoded length is 4 × ⌈n / 3⌉ characters for n bytes, about 33% more than the original. With MIME line breaks it grows by a further 2–3%.
Where Base64 is used
- Email attachments (MIME)
- Data URIs for images and fonts in HTML and CSS
- Binary fields in JSON and XML APIs
- JSON Web Tokens and OAuth
- HTTP Basic authentication headers
- PEM certificates and SSH keys
- Kubernetes secrets and configuration files
Frequently asked questions
Is Base64 the same as encryption or hashing?
No. Encryption needs a key to reverse, hashing cannot be reversed at all, while Base64 can be decoded by anyone.
Why is it called Base64?
Because it uses an alphabet of 64 characters, so each character carries 6 bits of information (26 = 64).
How can I tell if a string is Base64?
It contains only A–Z, a–z, 0–9, +, / (or - and _), its length is usually a multiple of 4, and it may end with one or two = signs. The quickest test is to paste it into our decoder.
Updated: