Base64 Encoder and Decoder Explained

Base64 is one of the most commonly used encoding schemes on the web. Every email attachment, every data URI, and countless API payloads rely on it. Yet most developers use it without truly understanding how it works.

What Is Base64?

Base64 is an encoding scheme that converts binary data into a string of 64 printable ASCII characters. It takes 3 bytes of binary data and represents them as 4 ASCII characters using the alphabet: A-Z, a-z, 0-9, +, and / (with = as padding).

The name "Base64" comes from the fact that it uses exactly 64 characters to represent data. This makes it safe to transmit over any system that handles text — email, URLs, JSON, XML, and more.

Why Does Base64 Exist?

Many systems were designed to handle only text data. Binary data (images, files, encrypted data) can get corrupted when passed through text-only channels because certain byte values have special meanings (null bytes, line breaks, etc.).

Base64 solves this by converting binary data into a text-safe representation. The trade-off is a ~33% increase in size — 3 bytes become 4 characters.

How Base64 Encoding Works

The encoding process works in 3-byte chunks:

1. Take 3 bytes (24 bits) of binary data
2. Split into 4 groups of 6 bits each
3. Map each 6-bit group to a Base64 character

For example, the word "Hey" in ASCII is:

• H = 72 = 01001000
• e = 101 = 01100101
• y = 121 = 01111001

Combined: 01001000 01100101 01111001

Split into 6-bit groups: 010010 000110 010101 111001

Mapped to Base64: S G V 5 → SGV5

If the input length isn't a multiple of 3, = padding is added:

• 1 remaining byte → 2 Base64 chars + ==
• 2 remaining bytes → 3 Base64 chars + =

Common Use Cases

Email Attachments

MIME (the email standard) uses Base64 to encode attachments. When you attach a PDF to an email, it's Base64-encoded before transmission.

Data URIs

Embed images directly in HTML or CSS:

<img src="data:image/png;base64,iVBORw0KGgo..." />

JWT Tokens

JSON Web Tokens use Base64URL (a URL-safe variant) for the header and payload sections.

API Authentication

HTTP Basic Authentication encodes username:password in Base64:

Authorization: Basic dXNlcjpwYXNz

Cryptography

Many cryptographic outputs (public keys, certificates, signatures) are displayed in Base64 for readability.

Base64 vs Base64URL

Standard Base64 uses + and /, which aren't URL-safe. Base64URL replaces them with - and _ and removes padding. JWT tokens use Base64URL.

| Variant | Characters | Padding | Use Case | |---------|-----------|---------|----------| | Standard | A-Z, a-z, 0-9, +, / | = | Email, general purpose | | URL-safe | A-Z, a-z, 0-9, -, _ | Optional | URLs, JWTs |

Encode and Decode in Code

JavaScript

// Encode
const encoded = btoa("Hello, World!");
// "SGVsbG8sIFdvcmxkIQ=="

// Decode
const decoded = atob("SGVsbG8sIFdvcmxkIQ==");
// "Hello, World!"

// Handle Unicode
function encodeUnicode(str) {
  return btoa(encodeURIComponent(str).replace(/%([0-9A-F]{2})/g,
    (_, p1) => String.fromCharCode(parseInt(p1, 16))
  ));
}

Python

import base64

# Encode
encoded = base64.b64encode(b"Hello, World!").decode()
# "SGVsbG8sIFdvcmxkIQ=="

# Decode
decoded = base64.b64decode("SGVsbG8sIFdvcmxkIQ==").decode()
# "Hello, World!"

Command Line

# Encode
echo -n "Hello, World!" | base64
# SGVsbG8sIFdvcmxkIQ==

# Decode
echo "SGVsbG8sIFdvcmxkIQ==" | base64 -d
# Hello, World!

Common Mistakes

1. Thinking Base64 is encryption — it's encoding, not encryption. Anyone can decode it. It provides zero security.

2. Forgetting to handle padding — some systems strip = padding. Always check if your decoder expects padding.

3. Using standard Base64 in URLs — + and / get mangled in URLs. Use Base64URL for URL contexts.

4. Decoding untrusted input — always validate and sanitize Base64 input before decoding. Malformed input can cause errors.

Try It Now

Use our free Base64 Encoder/Decoder to encode and decode Base64 strings instantly — with URL-safe variant support and file upload capability.