Base64 Encoder / Decoder

What Base64 Is and Isn't

Base64 is an encoding scheme that converts binary data into a text string using 64 printable ASCII characters (A–Z, a–z, 0–9, +, /). It was designed to safely transmit binary content through systems that only handle text — like email (MIME), embedding images in HTML/CSS via data URIs, and encoding binary data in JSON. Base64 is not encryption. It provides no security — anyone can decode it in seconds. Encoded data is approximately 33% larger than the original because each 3 bytes of binary becomes 4 characters of Base64.

Common Use Cases

Base64 encoding is ubiquitous in web development. JWTs (JSON Web Tokens) use Base64url encoding for their header and payload sections. Basic HTTP authentication encodes credentials as username:password in Base64. Email attachments are Base64-encoded in the MIME standard. Inline images in HTML (src="data:image/png;base64,...") use Base64 to avoid extra HTTP requests. API payloads that need to include binary data (file uploads, cryptographic keys, certificates) encode them as Base64 strings to maintain JSON compatibility.

URL-Safe Base64

Standard Base64 uses + and / characters, which have special meaning in URLs and must be percent-encoded if used in query parameters. URL-safe Base64 (Base64url) replaces + with - and / with _, making it safe for URL parameters and filename use without escaping. JWTs use Base64url. When passing Base64-encoded data in query strings, always use Base64url encoding or percent-encode the standard Base64 output.

Base64 vs Encryption

A common mistake is treating Base64 encoding as a security measure. It isn't. Base64 is reversible by anyone — there's no key, no secret, no computational cost to decode. If you need to protect data, use actual encryption (AES-256, ChaCha20) with a secret key. If you need to verify integrity, use a hash (SHA-256) or HMAC. Use Base64 only for what it's designed for: safely representing binary data as text for transmission or storage in text-only contexts.