Base64 in one minute
Computers store everything as bytes, and a byte can have 256 different values. Many older protocols and formats, such as email, URLs, JSON strings and HTTP headers, were designed for readable text and can mangle or reject bytes outside a small safe set. Base64 solves this by re-expressing the bytes with characters that survive everywhere.
The tool below encodes text to Base64 as you type and decodes it back with one click on Decode. Text is converted to UTF-8 first, so accented letters, other alphabets and emoji come back exactly as they were. The status line shows how many bytes of text became how many bytes of Base64.
Try it here: Base64 Encode
Open the full tool pageHow the encoding works, step by step
Base64 takes the input 3 bytes (24 bits) at a time and splits those 24 bits into four groups of 6 bits. Six bits can hold a number from 0 to 63, and each number is looked up in a fixed alphabet: 0 to 25 are A to Z, 26 to 51 are a to z, 52 to 61 are 0 to 9, 62 is + and 63 is /.
Take the word Man. Its bytes are 77, 97 and 110, or 01001101 01100001 01101110 in binary. Regrouped into 6 bit chunks this is 010011 010110 000101 101110, which is 19, 22, 5 and 46, and those map to T, W, F and u. So Man becomes TWFu.
When the input length is not a multiple of 3, the last group is padded. One leftover byte produces two characters plus ==, two leftover bytes produce three characters plus =. That is why Ma encodes to TWE= and M to TQ==, and why Hello (5 bytes) becomes SGVsbG8=.
Why Base64 is 33 percent bigger
Four output characters carry the information of three input bytes, so the size grows by a factor of 4/3, plus up to two padding characters. Some systems also insert a line break every 76 characters (email MIME) or every 64 characters (PEM certificates), which adds a few percent more.
| Original size | Base64 size | With 76 character lines |
|---|---|---|
| 3 bytes | 4 bytes | 4 bytes |
| 1 KB (1,024 bytes) | 1,368 bytes | about 1.4 KB |
| 100 KB | about 133 KB | about 137 KB |
| 1 MB | about 1.33 MB | about 1.37 MB |
| 10 MB email attachment | about 13.3 MB | about 13.7 MB |
Where you meet Base64
- Email attachments: MIME encodes files as Base64 with 76 character lines, which is why a 20 MB file can be rejected by a mail service with a 25 MB message limit: encoded, it is over 27 MB.
- Data URIs: images, fonts and icons embedded in HTML or CSS as data:image/png;base64, followed by the encoded file.
- HTTP Basic authentication: the header Authorization: Basic followed by username:password in Base64. It is readable by anyone who sees the header, so it is only safe over HTTPS.
- JSON Web Tokens: the header and payload are Base64url encoded JSON, which is why a JWT starts with eyJ (the encoding of the characters {").
- Certificates and keys: PEM files are Base64 between BEGIN and END lines.
- APIs and configuration: binary data in JSON fields, Kubernetes secrets, environment variables and database exports.
Base64 variants: standard, URL safe and MIME
Standard Base64 (RFC 4648) uses + and / and pads with =. Those three characters have special meanings in web addresses, so there is a URL safe variant, often called Base64url, that uses minus and underscore instead and usually drops the padding. JWTs and many web APIs use it. In the tool, turn on URL safe to get this form; the decoder accepts both forms and missing padding.
MIME Base64, used in email, is standard Base64 split into lines of at most 76 characters. Turn on 76 character lines when you need output for an email body or a PEM style file.
Base64 is not encryption
There is no key and no secret. Anyone who sees cGFzc3dvcmQxMjM= can decode it to password123 in a second. Treat Base64 encoded credentials, tokens and configuration exactly like plain text: do not commit them to public repositories, do not paste them into untrusted websites and do not use Base64 to hide anything. Kubernetes secrets, for example, are Base64 encoded by default, not encrypted.
If you need confidentiality, use real encryption (such as AES through a proper library) and then, if the ciphertext has to travel as text, encode that with Base64.
Common problems when decoding
- Garbled accented letters: the text was encoded with a different character set. In JavaScript, btoa only accepts characters up to code 255 and encodes them as Latin 1, so ü becomes /A== instead of the UTF-8 form w7w=, and characters such as the euro sign throw an error. Use a UTF-8 aware encoder like the tool on this page.
- Invalid character errors: the string contains spaces, line breaks or URL safe characters that a strict decoder rejects. This tool ignores line breaks and accepts both alphabets.
- Length is not a multiple of 4: the padding was removed. Add = until the length divides by 4, or use a decoder that handles it for you.
- The result looks like random symbols: the data is binary, such as an image, PDF or ZIP. The tool then says it is binary data, identifies the file type when it can and lets you save it with Download.
Encoding on the command line
On Linux, base64 file.txt encodes and base64 -d file.b64 decodes. On macOS the same base64 command exists; older versions use -D to decode. In Windows PowerShell, [Convert]::ToBase64String([IO.File]::ReadAllBytes("file.bin")) encodes a file, and certutil -encode input output works in the Command Prompt but adds BEGIN and END header lines. For quick checks with text, the browser tool is faster and does not leave the data in your shell history.