Is Base64 the same as encryption?

No. Base64 is an encoding scheme, fully reversible by anyone with no key. It provides no confidentiality. Use proper encryption (AES, RSA) or HTTPS to protect data.

How much larger is Base64 than the original?

Approximately 33% larger. Every 3 bytes of input becomes 4 characters. Consider this overhead when embedding images as data URIs.

When should I use Base64URL instead of Base64?

Use Base64URL for URLs, filenames, and JWT tokens. It replaces + with - and / with _, and drops padding =, avoiding conflicts with URL special characters.

What Is Base64 Encoding? Quick Explainer

Q: Why does Base64 output end with = or ==?

Base64 encodes 3 bytes into 4 characters. If input is not divisible by 3, padding = characters are added. One = means 1 padding byte, two == means 2 padding bytes.

Base64 is a binary-to-text encoding scheme that represents binary data as a sequence of ASCII characters. It converts arbitrary bytes into a string of 64 printable characters — the letters A–Z, a–z, digits 0–9, and the characters + and / (with = used for padding). The result is a string that can safely travel through any system designed to handle text.

Why Base64 Exists

Many systems and protocols were designed to handle text only. Email (SMTP) was designed to transmit 7-bit ASCII text — not arbitrary binary data. If you tried to send a PNG image or a PDF directly through an early email system, the binary bytes would be corrupted or stripped. Base64 was created to solve this: encode the binary data as printable ASCII text, transmit it safely, then decode it at the other end.

The same problem appears in other contexts: embedding binary data in JSON (which is a text format), storing binary data in databases with text columns, and including binary content in HTML or CSS. Base64 solves all of these by converting binary to safe text.

How Base64 Works

Base64 takes every 3 bytes of input (24 bits) and converts them to 4 Base64 characters (6 bits each). This is where the size overhead comes from: 3 bytes become 4 characters, so Base64-encoded data is always approximately 33% larger than the original binary.

The 64 characters in the alphabet are chosen because they are printable and safe in virtually every text context. The character set avoids control characters, spaces, and characters that have special meaning in XML, HTML, or URLs.

If the input is not divisible by 3, padding characters (=) are added to make the output length a multiple of 4. One = means one byte of padding was needed, two == means two bytes.

# "Man" encodes to "TWFu"
M  = 77  = 01001101
a  = 97  = 01100001
n  = 110 = 01101110

# Grouped into 6-bit chunks:
010011 | 010110 | 000101 | 101110
  19   |   22   |    5   |   46
   T   |    W   |    F   |    u
      

Common Uses

Base64 appears in more places than most developers realise. Email attachments are Base64-encoded inside MIME messages. HTTP Basic Authentication sends credentials as username:password encoded in Base64 in the Authorization header. JWT tokens use Base64URL encoding (a URL-safe variant) for their header and payload sections. Data URIs embed images directly in HTML or CSS as data:image/png;base64,..., eliminating an HTTP request. SSH keys and TLS certificates are stored and transmitted as Base64-encoded PEM files.

Encode or decode Base64 instantly Supports standard and URL-safe Base64, handles Unicode input correctly.

Open Base64 Tool →

Base64 vs Base64URL

Standard Base64 uses + and / in its alphabet, and pads with =. These characters have special meanings in URLs — + means space in query strings, / is a path separator, and = can cause issues in some URL contexts. Base64URL replaces + with -, / with _, and omits the padding =. Use Base64URL whenever the encoded string will appear in a URL, a filename, or a JWT token.

Base64 in Code

// JavaScript — browser and Node.js
btoa("Hello World")              // → "SGVsbG8gV29ybGQ="
atob("SGVsbG8gV29ybGQ=")        // → "Hello World"

// Node.js — Buffer for binary data
Buffer.from("Hello").toString("base64")     // → "SGVsbG8="
Buffer.from("SGVsbG8=", "base64").toString() // → "Hello"

# Python
import base64
base64.b64encode(b"Hello World")  # → b'SGVsbG8gV29ybGQ='
base64.b64decode("SGVsbG8gV29ybGQ=")  # → b'Hello World'

# Command line
echo -n "Hello World" | base64        # encode
echo "SGVsbG8gV29ybGQ=" | base64 -d  # decode
      

What Base64 Is Not

Base64 is not encryption. It provides zero security — anyone can decode Base64 in seconds. It is an encoding scheme, not a cipher. Storing a password or API key in Base64 and calling it "encoded" is not a security measure. If you see Base64 in a security context, it is only being used to safely transport data, not to protect it — the actual security must come from something else (HTTPS, proper authentication, encryption at rest).

Frequently Asked Questions

Is Base64 the same as encryption?: No. Base64 is an encoding scheme — it is fully reversible by anyone with no key or secret. It provides no confidentiality. It exists to make binary data safe for text-only systems, not to protect data. If you need to protect data, use proper encryption (AES, RSA) or HTTPS.
Why does Base64 output always end with = or ==?: Base64 encodes 3 bytes at a time into 4 characters. If the input is not divisible by 3, one or two = padding characters are added to make the output length a multiple of 4. One = means 1 padding byte was added, two == means 2 bytes of padding. Input already divisible by 3 produces no padding. Base64URL omits padding entirely.
How much larger is Base64 than the original data?: Base64-encoded data is approximately 33% larger than the input. Every 3 bytes of input becomes 4 characters of output. Additionally, some implementations add line breaks every 76 characters (as required by MIME), which adds a small overhead. For embedding images in CSS or HTML via data URIs, this size increase is worth considering against the HTTP request it saves.
When should I use Base64URL instead of Base64?: Use Base64URL whenever the encoded string will appear in a URL, filename, or JWT token. Base64URL replaces + with - and / with _, and drops the = padding. This avoids conflicts with URL special characters. JWT tokens always use Base64URL for this reason. Our Base64 tool supports both standard and URL-safe encoding.

What Is Base64 Encoding?