Base64 Encoding Explained: How to Encode and Decode

Base64 encoding converts binary data into text made of 64 safe characters: A–Z, a–z, 0–9, + and /. Every 3 bytes of input become 4 characters of output, so encoded data is about 33% larger, but it can travel through systems that only handle plain text.

Base64 is an encoding, not encryption: anyone can decode it without a key. To encode text or decode a Base64 string right now, use our free Base64 converter. The rest of this guide explains how the algorithm works, where Base64 is used, and the mistakes that cause "invalid Base64" errors.

How Base64 encoding works

Base64 is specified in RFC 4648. The encoder reads input three bytes (24 bits) at a time, splits those bits into four groups of 6 bits, and maps each 6-bit number (0 to 63) to one character of the alphabet. Index 0 is A, 25 is Z, 26 is a, 51 is z, 52 to 61 are the digits, 62 is + and 63 is /.

Worked example: encoding "Man"

Step	M	a	n
ASCII value	77	97	110
Binary	01001101	01100001	01101110

Joined, the 24 bits are 010011 010110 000101 101110. Those four 6-bit groups are 19, 22, 5 and 46, which map to T, W, F and u. So "Man" encodes to TWFu.

Why Base64 strings end with = or ==

When the input length is not a multiple of three, the last group is padded. One leftover byte produces two characters plus ==, and two leftover bytes produce three characters plus =:

Man  →  TWFu
Ma   →  TWE=
M    →  TQ==

The output length is always 4 × ceil(n ÷ 3) characters for n input bytes, before any line breaks are added.

Common Base64 use cases

• Email attachments. MIME (RFC 2045) uses Base64 to send images and files through mail systems designed for text, wrapping lines at 76 characters.
• Data URIs. Small icons can be embedded directly in HTML or CSS as data:image/png;base64,..., saving a separate request.
• HTTP Basic authentication. The Authorization: Basic header carries username:password encoded in Base64 (RFC 7617). It is only safe over HTTPS.
• Binary data in JSON and XML. Neither format has a binary type, so APIs encode files, hashes and keys as Base64 strings.
• JSON Web Tokens. Each part of a JWT is encoded with the URL-safe variant, Base64URL.
• Certificates and keys. PEM files wrap Base64 between lines such as -----BEGIN CERTIFICATE-----.
• Kubernetes Secrets. Values in a Secret's data field are Base64-encoded, which hides them from a casual glance but does not protect them.

Base64 vs Base64URL

Standard Base64 uses + and /, which have special meanings in URLs and file names. RFC 4648 also defines a URL-safe alphabet that swaps those two characters:

	Base64	Base64URL
Characters 62 and 63	+ and /	- and _
Padding	Usually included	Usually omitted
Typical use	Email, data URIs, PEM, APIs	JWTs, URL parameters, file names

For example, the bytes of <<??>> encode to PDw/Pz4+ in standard Base64 and to PDw_Pz4- in Base64URL.

How to use the Base64 Converter

1. Open the Base64 converter and choose Encode or Decode.
2. Type or paste your input, up to 100,000 characters. The result updates automatically as you type.
3. In Encode mode, text is encoded as UTF-8 bytes, so café becomes Y2Fmw6k=.
4. In Decode mode, spaces and line breaks are ignored and missing = padding is accepted. If the input is not valid standard Base64, an "Invalid Base64 string." error appears above the panes and the output stays empty.
5. Click Copy to copy the result, or Clear to start again.

The converter works with text. If the decoded bytes are not valid UTF-8 text, such as an image or a ZIP file, it says the data decoded successfully and how many bytes of binary data it holds, instead of showing unreadable characters.

Common mistakes and security notes

• Treating Base64 as encryption. It provides no secrecy at all. Credentials in a Basic auth header or a Kubernetes Secret are readable by anyone who sees them. Use real encryption, and generate secrets with a password generator instead of disguising weak ones.
• Decoding URL-safe strings as standard Base64. Our converter decodes the standard alphabet. Replace - with + and _ with / first, or use the JWT decoder for tokens.
• Leaving the data URI prefix in place. Remove data:image/png;base64, before decoding; only the part after the comma is Base64.
• Mixing character encodings. The same text encoded as UTF-8 and as Latin-1 produces different Base64. Most modern systems expect UTF-8.
• Inlining large files. The 33% size overhead adds up. Data URIs suit small icons, not photos.
• Pasting secrets into web tools. Our converter processes input on our server. Do not paste production credentials, private keys or personal data into it or any other online tool.

Base64 often appears alongside JSON. If a decoded string turns out to be JSON, paste it into the JSON formatter to read it. For the token format that combines both, see our guide on how to decode a JWT, and for creating credentials that are actually secret, read how to generate strong passwords.

Frequently asked questions

Is Base64 encryption?

No. Base64 is a reversible encoding with a public alphabet and no key, so anyone can decode it instantly. It changes how data is represented, not who can read it.

How much larger does Base64 make data?

Base64 output is about 33% larger than the input, because every 3 bytes become 4 characters. Line breaks added by formats such as MIME increase the size slightly more.

What does the = sign mean at the end of Base64?

The = characters are padding. They appear when the input length is not a multiple of three bytes: one = means two bytes were left over, and == means one byte was left over.

What is the difference between Base64 and Base64URL?

Base64URL replaces + with - and / with _ so the result is safe in URLs and file names, and it usually drops the padding. Both are defined in RFC 4648.

Why do I get an "invalid Base64" error?

The most common causes are URL-safe characters (- or _), a leftover data: prefix, a truncated string, or characters outside the Base64 alphabet. Clean the input and decode again.

Can I decode a Base64 image with this tool?

Our converter decodes text. For an image or other binary file it confirms the data decoded successfully but does not display or download the file.