Base64 is a way of representing binary data, such as images or files, using only plain text characters. You will run into it in email attachments, data URLs, API payloads, and authentication headers.
Why does Base64 exist?
Many systems were built to handle text only. Sending raw binary through them can corrupt the data. Base64 solves this by converting bytes into a safe set of 64 characters: A-Z, a-z, 0-9, +, and /, with = used for padding.
How it works, in short
Base64 takes 3 bytes (24 bits) at a time and splits them into four 6-bit groups. Each group maps to one character. That is why the output is always about 33% larger than the original data.
Simple examples
ManbecomesTWFuHellobecomesSGVsbG8=
The = at the end is padding, added when the input length is not a multiple of 3.
Where you will see it
- Data URLs: small images embedded directly in HTML or CSS
- Email (MIME): attachments are encoded as Base64
- HTTP Basic Authentication:
username:passwordis Base64-encoded in the header - JWTs: use a URL-safe variant called Base64URL
Important: Base64 is not encryption
Anyone can decode Base64 instantly. It hides nothing. Never use it to protect passwords, tokens, or personal data. If you see credentials in Base64, treat them as plain text.
Encode and decode quickly
Paste text or a string into a Base64 converter to switch between plain text and Base64 in one click. If you are inspecting a token, a JWT decoder will split and decode the parts for you.
Common problems
- Missing padding: some systems strip the
=characters, which can cause decoding errors. - URL-safe variant: Base64URL swaps
+and/for-and_. Mixing the two causes failures. - Line breaks: some encoders insert line breaks every 76 characters. Remove them if your decoder does not expect them.
- Character encoding: text with accents or emoji should be converted to UTF-8 before encoding.
When to avoid Base64
For large images on a website, Base64 data URLs make pages heavier and harder to cache. A normal image file is usually the better choice.
