Base64 encoding converts binary data into a text representation using 64 printable ASCII characters. It is one of the most widely used encoding schemes in web development — appearing in data URIs, API payloads, email attachments, JWT tokens, and configuration files wherever binary data must travel through text-only channels.
This guide explains how Base64 works, when to use it, its overhead cost, and common mistakes developers make when encoding and decoding data.
How Base64 encoding works
Base64 takes every 3 bytes (24 bits) of input and splits them into 4 groups of 6 bits. Each 6-bit group maps to one of 64 characters: A-Z (0-25), a-z (26-51), 0-9 (52-61), + (62), and / (63). If the input length is not a multiple of 3, padding characters (=) are appended to fill the final group.
This encoding expands data by approximately 33% — 3 bytes become 4 characters. The trade-off is worthwhile when the transport layer only supports text (HTTP headers, JSON values, XML content, email bodies) and cannot handle raw binary data safely.
Common use cases
Data URIs embed small files directly in HTML or CSS: an image becomes src='data:image/png;base64,...' which eliminates an HTTP request at the cost of a larger HTML document. This is useful for icons under 2-3 KB where the encoding overhead is smaller than the round-trip latency of a separate request.
API payloads frequently use Base64 to embed binary content (images, documents, certificates) inside JSON request or response bodies. JWT tokens encode their header and payload sections as Base64url (a URL-safe variant that replaces + with - and / with _).
Email attachments are Base64-encoded per the MIME standard because SMTP only supports 7-bit ASCII text. Every email attachment you have ever sent was Base64-encoded behind the scenes.
Base64 variants and URL safety
Standard Base64 uses + and / which are special characters in URLs and filenames. Base64url replaces them with - and _ respectively, and omits padding (=). Always use Base64url for URL parameters, filenames, and JWT tokens.
Use the Base64 Encoder to encode and decode both standard and URL-safe variants. Paste any text or upload a file to see the encoded output instantly.
Common mistakes to avoid
Do not use Base64 for encryption or security — it is an encoding, not a cipher. Anyone can decode Base64 without a key. For actual encryption, use AES.
Avoid Base64-encoding large files for data URIs. Images over 5 KB are better served as separate files because the 33% size increase outweighs the saved HTTP request. The encoding also prevents browser caching of the embedded resource.
When decoding, ensure you use the matching variant. Decoding a Base64url string with a standard decoder (or vice versa) produces garbled output because + / - _ map to different values.
Key takeaways
- Base64 converts binary data to text using 64 ASCII characters, expanding size by ~33%.
- Use Base64 when binary data must travel through text-only channels: data URIs, JSON APIs, email attachments, JWT tokens.
- Use Base64url (- and _ instead of + and /) for URL parameters, filenames, and tokens.
- Base64 is encoding, not encryption — it provides no security. Anyone can decode it without a key.
- Avoid Base64 for images over 5 KB in data URIs — the 33% overhead and loss of caching outweigh the saved request.
Frequently asked questions
Is Base64 encoding secure?
No. Base64 is an encoding scheme, not encryption. It converts binary to text for transport but provides zero security. Anyone can decode it instantly without a key.
Why does Base64 make files larger?
Base64 represents 3 bytes as 4 characters, a 33% expansion. This is the cost of encoding binary data into text-safe characters for channels that only support ASCII.
What is the difference between Base64 and Base64url?
Base64url replaces + with - and / with _ to avoid URL-special characters, and omits trailing = padding. Use Base64url for URLs, filenames, and JWT tokens.
When should I use Base64 encoding?
Use Base64 for embedding small images as data URIs, sending binary files in JSON APIs, encoding email attachments, and JWT token payloads. Avoid it for large files or security purposes.
Related tools
Base64 Encoder
Encode and decode Base64 strings and files
URL Encoder
Encode and decode URL components
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3, and 25+ other cryptographic hashes instantly
AES Encrypt / Decrypt
Encrypt and decrypt data with AES-128, AES-192, or AES-256 in CBC, CFB, CTR, OFB, and ECB modes
Related guides
URL Encoding: Percent-Encoding for Web Developers
A practical reference for URL encoding (percent-encoding), covering reserved characters, query parameters, internationalized URLs, and common encoding mistakes.
AES vs DES vs Triple DES: Encryption Algorithms Explained
An educational overview of symmetric encryption algorithms, their security levels, key sizes, and when to use each one in modern applications.