What Base64 encoding is
Base64 is an encoding scheme that converts binary data into a string of printable ASCII characters. The name comes from the 64-character alphabet it uses: A–Z, a–z, 0–9, plus + and /. Any binary input — an image, a PDF, a certificate — can be represented as a Base64 string that contains no control characters, null bytes, or characters that break text protocols.
The math is straightforward. Every 3 bytes of binary input maps to 4 Base64 characters. This means encoding always increases data size by approximately 33%. A 300 KB image encoded as Base64 becomes roughly 400 KB of text. That overhead is the tradeoff for compatibility with systems that handle only text.
Where Base64 is used
Base64 appears throughout web development and systems programming. The most common use case is data URIs — embedding small images or fonts directly in HTML or CSS as data:image/png;base64,... strings, eliminating an HTTP request. This is standard practice for icons and inline SVGs in email templates where external URLs may be blocked.
Email attachments are Base64-encoded by the MIME standard. When your email client attaches a file, the mail transfer agent encodes the binary as Base64 so it can travel through SMTP servers that only pass 7-bit ASCII. The recipient's client decodes it transparently on arrival.
HTTP Basic Authentication sends credentials as Authorization: Basic Base64(username:password) in the request header. This is encoding, not encryption — the credentials are trivially recoverable from the header. Basic Auth should only be used over HTTPS. JSON APIs frequently carry Base64-encoded binary payloads when the API spec requires all fields to be valid JSON strings.
Base64 is not encryption
This distinction matters and is frequently misunderstood. Base64 is a reversible encoding with no key, no secret, and no computational difficulty. Decoding a Base64 string requires only the algorithm — which is public and implemented in every programming language's standard library. Anyone who sees a Base64 string can decode it in seconds.
Storing a password as a Base64 string provides no security. Sending sensitive data in a Base64-encoded header over HTTP provides no security. If you need confidentiality, use encryption (AES, RSA) or a proper secrets manager. Base64 solves a compatibility problem, not a security problem.
How to encode and decode Base64
Open the Base64 encoder/decoder. To encode: paste or type your input text in the left field, select "Encode", and the Base64 output appears immediately in the right field. To decode: paste a Base64 string, select "Decode", and the original text appears. The tool processes everything client-side — nothing is sent to a server.
For binary files, use the file upload option. Upload an image or document and the tool returns its Base64 representation, ready to paste into a data URI or API payload. The output includes the correct MIME prefix (data:image/jpeg;base64,) when encoding image files, so it can be pasted directly into an <img src="..."> attribute.
URL-safe Base64 variant
Standard Base64 uses + and /, both of which have special meaning in URLs. When a Base64 string appears in a query parameter or path segment, those characters must be percent-encoded, which breaks the string's readability and increases its length. The URL-safe variant (defined in RFC 4648) replaces + with - and / with _.
JSON Web Tokens (JWTs) use URL-safe Base64 without padding — the = characters at the end are omitted. OAuth tokens, state parameters, and signed URLs across Google Cloud Storage and AWS S3 all use the URL-safe variant. The encoder/decoder supports both standard and URL-safe modes; toggle the switch before encoding if you are building a JWT or OAuth flow. For further encoding needs, the URL encoder/decoder handles percent-encoding of full query strings, and the JWT decoder splits and decodes all three JWT segments directly.
Using Base64 in practice
Base64 is plumbing — it shows up whenever binary data needs to travel through a text-only channel. Knowing when to use it and, more importantly, when not to use it (confidential data, large files, performance-sensitive payloads) keeps your implementation correct. The 33% size overhead matters for large files but is negligible for small icons and short tokens.
When you need to encode or inspect a Base64 string, the Base64 encoder/decoder handles text and binary files without requiring an account or an internet round-trip for your data.