What Is Base64 Encoding? (And Why It's Not Encryption)

Base64 is one of those things you see constantly — in data URLs, email attachments, JWTs, API responses — without always knowing what it's doing. The single most important thing to understand is what it is not: it is not encryption. Let's clear it up.

What problem does Base64 solve?

Many systems were designed to handle text, not arbitrary binary data. Email headers, URLs, JSON and XML can choke on raw bytes — control characters, null bytes, or anything outside a safe range can break them. Base64 solves this by representing any binary data using only 64 "safe" printable characters, so it can travel through text-only channels intact.

How it works

Base64 takes three bytes of input (24 bits) and splits them into four groups of six bits. Each 6-bit group (0–63) maps to one character from the Base64 alphabet: A–Z, a–z, 0–9, plus + and /. Because three input bytes become four output characters, Base64 output is about 33% larger than the original — the price of being text-safe.

When the input length isn't a multiple of three, Base64 pads the end with one or two = characters so the output stays a multiple of four. That's why you often see = at the end of an encoded string.

Base64 is NOT encryption

This bears repeating because it causes real security incidents. Base64 is fully reversible without any key — anyone can decode it in seconds. Encoding a password or API key in Base64 provides exactly zero protection; treat an encoded secret as if it were written in plain text. If you need confidentiality, encrypt the data; if you need integrity, hash it. Base64 only makes bytes printable.

Base64 vs Base64url

The standard alphabet uses + and /, which have special meaning inside URLs. The URL-safe variant — Base64url — replaces them with - and _ and usually drops the = padding. JWTs and many web APIs use Base64url, which is why a token's parts contain - and _ but never + or /.

The UTF-8 gotcha

A frequent bug is encoding non-ASCII text (accents, emoji, CJK characters) with a naive function that only handles single-byte characters. The fix is to encode the text as UTF-8 bytes first, then Base64 those bytes. A good encoder does this for you so "Café 🎉" round-trips correctly.

Where you'll see it

• Embedding small images or fonts directly in CSS/HTML as data: URLs.
• Putting binary blobs (certificates, keys, attachments) inside JSON or XML.
• HTTP Basic Auth, which Base64-encodes user:password (and therefore needs HTTPS to be safe).
• Encoding the header and payload of a JWT (as Base64url).

Try it

Encode and decode text — with proper UTF-8 handling — using our Base64 converter. To see how the same bytes look in hexadecimal, try the hex ↔ text converter, and to inspect a Base64url-encoded token, use the JWT decoder.