Base64 Explained

What Base64 Really Is

Base64 is a scheme for representing arbitrary binary data using only 64 printable ASCII characters: A–Z, a–z, 0–9, + , and /, with = as padding. Three bytes of input become four characters of output — a 33% size increase.

Why It Exists

Many protocols originally allowed only 7-bit ASCII: SMTP, early HTTP headers, URL paths. If you need to carry a PNG, a key, or a JWT through such a channel, you need a text-safe representation. Base64 is that representation.

Standard vs URL-Safe

Standard Base64 (RFC 4648 §4) uses + and /. In URLs and filenames these characters have special meanings, so URL-safe Base64 (§5) swaps them for - and _ and often drops padding. JWTs use URL-safe Base64 for exactly this reason.

Legitimate Uses

• Data URIs: inline images in CSS/HTML
• JWT: header and payload segments are URL-safe Base64
• HTTP Basic Auth: username:password encoded
• Email attachments (MIME): binary parts of emails
• Binary in JSON: small blobs embedded in text payloads

Common Mistakes

Base64 is not encryption. Anyone can decode it with one line of code. Never use it to "hide" secrets. Don't Base64-encode a password hash and think you've added security — you haven't. If data must be confidential, encrypt it; if data must be authenticated, sign it.

Beware of size inflation. A 10 MB PDF becomes a ~13.3 MB Base64 string. For large payloads, prefer binary channels (multipart uploads, gRPC, raw WebSocket frames).

Try It

Encode and decode strings in your browser with our free String ↔ Base64 converter, or decode JWT tokens with the JWT Decoder.