Every developer meets Base64 sooner or later: that string of letters, numbers, and trailing = signs that shows up in emails, JWTs, CSS data URLs, and API responses. It looks like gibberish, but it's actually a simple, reversible encoding that's been around since the 1980s. Here's what it is, when you actually need it, and how to encode and decode it in seconds.
What is Base64, in plain English?
Base64 is a way to represent binary data (bytes) using only 64 safe text characters: A–Z, a–z, 0–9, +, and /, plus = for padding. It exists because many systems — email servers, JSON, URLs, XML — were built to carry text, not raw bytes. Base64 converts bytes into a text-safe form so they can travel through those systems without corruption.
It's called "Base64" because each output character represents 6 bits (2⁶ = 64 possible values). Every 3 bytes of input become 4 characters of output, which is why Base64 text is about 33% larger than the original data.
When should you use Base64? (And when not)
| Use case | Good idea? | Why |
|---|---|---|
| Embedding images in HTML/CSS as data URLs | ✅ Yes (small images) | Avoids extra HTTP requests; perfect for icons and thumbnails |
| Sending attachments in MIME email | ✅ Yes | Email was text-only; Base64 is how attachments survive |
| Passing binary data in JSON/APIs | ✅ Yes | JSON can't hold raw bytes — Base64 is the standard bridge |
| Storing passwords or secrets | ❌ No | Base64 is encoding, not encryption — trivially reversible |
| Encrypting data | ❌ No | Use AES or another real cipher; Base64 adds zero security |
| Compressing data | ❌ No | It makes data ~33% bigger, never smaller |
Base64 is a transport format, not a security mechanism. Anything you can Base64-encode, anyone else can Base64-decode — including your secrets.
How does Base64 encoding work?
It's a simple three-step process:
- Take your data as bytes. "Hi!" becomes the bytes
0x48 0x69 0x21. - Group them into 24-bit chunks (3 bytes each), then split each chunk into four 6-bit groups.
- Map each 6-bit value to a character from the Base64 alphabet: 0→
A, 1→B, … 63→/. If the input isn't a multiple of 3 bytes, add=padding at the end.
So Hi! encodes to SGkh. Try it yourself with a free online Base64 encoder — paste "Hi!" and you'll see SGkh appear instantly.
Real-world examples you've probably seen
- JWTs: the middle part of a JWT (the payload) is Base64url-encoded JSON. Decode it and you can read the claims directly.
- Data URLs:
data:image/png;base64,iVBORw0KGgo…in CSS or HTML embeds the whole image as text. - Basic Auth:
Authorization: Basic dXNlcjpwYXNzis Base64("user:pass"). - Email attachments: every attachment in your inbox was Base64-encoded in transit.
- API debugging: if an API returns a Base64 blob, decoding it locally is often faster than re-requesting it in another format.
Base64 vs. Base64url: what's the difference?
Standard Base64 uses + and /, which have special meaning in URLs. Base64url (used in JWTs and web-safe contexts) swaps them for - and _ and drops the = padding. If you're putting Base64 into a URL or a filename, use the URL-safe variant; most good tools offer both.
Frequently asked questions
Is Base64 encryption?
No. Base64 is encoding — it changes the representation of data so it can be transported safely, but anyone can reverse it with a decoder. Never use it to protect passwords, API keys, or confidential data.
Why does Base64 output end with = or ==?
Padding. Because encoding works in 3-byte blocks, inputs that aren't a multiple of 3 bytes get 1 or 2 = characters appended to make the output length a multiple of 4. Not all strings have padding — it depends on the input length.
Does Base64 make data smaller?
No — the opposite. Base64 expands data by about 33%. It's a transport encoding, not a compression scheme. For smaller payloads, compress first (e.g., gzip), then encode.
Can I decode Base64 without a tool?
Yes, if you have a terminal: echo "SGkh" | base64 -d on macOS/Linux, or certutil -decode on Windows. But a browser tool is faster, keeps the data on your machine, and handles both encode and decode plus URL-safe mode in one place.
Is Base64 still used in 2026?
Absolutely — it's everywhere: JWTs, data URLs, API payloads, email, and cloud storage metadata. It's one of the few encoding schemes that has only become more common with time.
Need more developer utilities? Check the full list of free Tooly tools — including JSON to CSV, SHA-256 hash generator, UUID generator, and timestamp converter — all free, no signup, and processed locally in your browser.