Base64 Encoder / Decoder

How Base64 Encoding Works

Base64 is an encoding scheme that converts binary data into a string of ASCII characters. It works by taking every 3 bytes of input (24 bits) and splitting them into four 6-bit groups. Each 6-bit group maps to one of 64 characters — A–Z, a–z, 0–9, plus + and /. If the input isn't divisible by 3, padding characters (= or ==) are added to the end.

Base64 doesn't encrypt data — it just changes how it's represented. A Base64 string is about 33% larger than the original data. The purpose is compatibility: many systems that handle text can't reliably transmit raw binary, so Base64 encodes binary into safe ASCII text.

Worked Example

The text "Hello" encoded in Base64:

Standard vs URL-safe Base64

Standard Base64 uses + and / as its 62nd and 63rd characters. These have special meaning in URLs — + means a space, / separates path segments. URL-safe Base64 (also called Base64URL) replaces them with - and _, making the output safe to use in URLs and filenames without percent-encoding. Use URL-safe mode when encoding data for JWT tokens, OAuth parameters, or anything going into a URL. For encoding the URL parameters themselves, use our URL Encoder instead.

Common Uses

Base64 encoding is used in email attachments (MIME), embedding images directly in HTML or CSS as data URIs, storing binary data in JSON or XML, encoding the header and payload sections of JWT tokens, and transmitting API keys or credentials in HTTP Basic Authentication headers. When working with JSON payloads that contain Base64-encoded data, use our JSON Formatter to inspect and validate the surrounding JSON structure.

Frequently Asked Questions

What is Base64 encoding used for?

Base64 is used whenever binary data needs to travel through systems designed for text. Common examples include email attachments encoded with MIME, embedding images in HTML or CSS as data URIs, encoding JWT tokens, and sending credentials in HTTP Basic Authentication headers. It ensures data stays intact during transmission without being misinterpreted as control characters.

Is Base64 the same as encryption?

No. Base64 is encoding, not encryption. It changes the representation of data but provides zero security — anyone can decode a Base64 string instantly without a key. Encrypted data is protected by a secret key and cannot be reversed without it. Never use Base64 to hide sensitive data. Use it only for encoding binary data for safe transmission or storage.

Why does Base64 output end with = or ==?

Base64 encodes 3 bytes at a time. If the input length isn't a multiple of 3, padding characters are added to complete the final group. One = means one padding byte was added; == means two were added. URL-safe Base64 often omits padding entirely since the = sign requires percent-encoding in URLs.

What is the difference between standard Base64 and URL-safe Base64?

Standard Base64 uses + and / as characters, which are reserved in URLs. URL-safe Base64 replaces these with - and _, making the output safe for use in URLs, filenames, and HTTP headers without percent-encoding. JWT tokens always use URL-safe Base64. Use the toggle on this tool to switch between them.

How do I decode a Base64 JWT token?

A JWT has three parts separated by dots: header, payload, and signature. Each is Base64URL encoded. To read the payload, copy the middle section (between the first and second dot), switch this tool to Decode mode with URL-safe enabled, and paste it in. The result is a JSON object containing the token's claims. Note that the signature section cannot be verified client-side without the secret key.

Does Base64 encoding make data larger?

Yes — Base64 output is approximately 33% larger than the original input. This is because every 3 bytes of input become 4 ASCII characters. For a 1 KB file, the Base64 output will be roughly 1.37 KB. This size increase is the trade-off for guaranteed text-safe transmission across systems that can't handle raw binary data.