What Is Base64 Encoding? A Simple Explanation With Examples

Why Base64 exists

Computers store everything as bytes, and a byte can have any of 256 values. Many systems were designed to carry text, though, and some byte values have special meanings in them: control characters, line endings, quotes or characters that get mangled between systems. Sending raw binary through them can corrupt it.

Base64 solves this by translating any bytes into a small, safe alphabet that survives any text system intact.

How Base64 encoding works, step by step

Let's encode the word Man:

1. Convert characters to bytes. M = 77, a = 97, n = 110.
2. Write them in binary (8 bits each): 01001101 01100001 01101110.
3. Regroup into 6-bit chunks: 010011 010110 000101 101110.
4. Convert each chunk to a number: 19, 22, 5, 46.
5. Look up each number in the Base64 alphabet (A=0 … Z=25, a=26 … z=51, 0=52 … 9=61, +=62, /=63): 19 = T, 22 = W, 5 = F, 46 = u.

Result: Man → TWFu. Every 3 bytes become 4 characters, which is why Base64 output is about a third larger than the input.

What's the "=" at the end?

When the input isn't a multiple of 3 bytes, the output is padded with = so its length is a multiple of 4. Ma becomes TWE= and M becomes TQ==.

Common uses of Base64

• Data URLs: embed small images directly in HTML or CSS: <img src="data:image/png;base64,iVBORw0KGgo…">.
• Email attachments: MIME encodes attachments in Base64 so they survive mail servers.
• APIs: send files or binary data inside JSON, which only supports text.
• HTTP Basic Authentication: username:password is Base64-encoded in the Authorization header.
• JSON Web Tokens (JWT): the header and payload are URL-safe Base64.
• Certificates and keys: PEM files are Base64 between "BEGIN" and "END" lines.

Base64 is not encryption

Standard vs URL-safe Base64

Standard Base64 uses + and /, which have special meanings in URLs and file paths. URL-safe Base64 (also called Base64URL) replaces them:

	Standard	URL-safe
Character 62	+	-
Character 63	/	_
Padding	=	Usually omitted
Used in	Email, data URLs, PEM	JWTs, URL parameters, file names

How to encode and decode Base64

1. Open the free Base64 Encoder / Decoder.
2. In the Text tab, type or paste text to encode, or Base64 to decode. Results update as you type.
3. Turn on URL-safe mode for tokens and URLs.
4. In the File tab, encode an image or document to get a Base64 string or data URL, or decode Base64 back into a downloadable file.

Everything runs in your browser. Text is handled as UTF-8, so accents, non-Latin scripts and emoji round-trip correctly.

Base64 in code

// JavaScript (browser, ASCII text only)
btoa('Man');      // "TWFu"
atob('TWFu');     // "Man"

# Python
import base64
base64.b64encode(b'Man')      # b'TWFu'
base64.b64encode(b'\xfb\xff')          # b'+/8='
base64.urlsafe_b64encode(b'\xfb\xff')  # b'-_8='  (URL-safe)

# Command line (macOS / Linux)
echo -n 'Man' | base64        # TWFu

Note: the browser's btoa() only accepts characters in the Latin-1 range. For full Unicode text, encode it to UTF-8 bytes first, for example with TextEncoder.

When not to use Base64

• Large images on web pages. Inlining makes your HTML or CSS heavier, and the image can't be cached separately. Inline only small icons, typically a few KB.
• Storing files in databases when your database supports binary columns.
• Anything that needs to be secret. Use real encryption.

Frequently asked questions

Why does Base64 make files bigger?

Each Base64 character carries 6 bits of data, but takes 8 bits to store. So 3 bytes of input become 4 bytes of output, a 33% increase (slightly more with line breaks).

How can I tell if a string is Base64?

It uses only A–Z, a–z, 0–9, + / (or - _), its length is often a multiple of 4, and it may end with = or ==. Try decoding it to be sure.

Why does my decoded text look like gibberish?

The data is probably a binary file such as an image or PDF, not text. Decode it as a file instead.

The bottom line

Base64 is a translation layer that lets binary data travel safely through text. It's essential for data URLs, email, APIs and tokens, but it adds 33% to the size and offers no security at all.