Base64 encoding

What Base64 is, why it exists, how it works, and the cases where it is the wrong tool.

What Base64 is

Base64 is a way to represent arbitrary binary data using only 64 printable ASCII characters (A–Z, a–z, 0–9, + and /, with = for padding). It is an encoding, not encryption: anyone can decode it, and it provides no confidentiality or integrity.

It was designed for a world where data had to travel through systems built for plain text — email (SMTP), early Usenet, and various configuration formats — that might mangle control characters or 8-bit bytes.

Man → TWFu

M a n
01001101 01100001 01101110   (3 bytes / 24 bits)
|||||||| |||||||| ||||||||
T  W  F  u  (split into four 6-bit groups → 4 Base64 chars)

How the encoding works

Base64 groups the input into 3-byte (24-bit) chunks, then splits each chunk into four 6-bit values. Each 6-bit value (0–63) maps to one character in the alphabet. If the final chunk has only 1 or 2 bytes, it is zero-padded and the output is padded with one or two = signs.

3 input bytes → exactly 4 output characters (no padding).
2 input bytes → 3 characters + one = pad.
1 input byte → 2 characters + two = pads.

💡

Base64 makes data about 33% larger (4 chars per 3 bytes). Never use it to save space — that is what compression (gzip, zstd) is for.

Where you actually see it

Data URLs in CSS/HTML: data:image/png;base64,iVBORw0… embeds a small image inline.
HTTP: Basic auth sends Authorization: Basic base64(user:pass) (over TLS only!).
JSON / APIs: binary blobs (files, keys) are often Base64-encoded before being placed in a text field.
Certificates & keys: PEM files are Base64-wrapped DER with -----BEGIN…----- headers.
Email attachments: MIME Content-Transfer-Encoding: base64.

⚠️

Base64 is not a security control. Encoding a password in Base64 is the same as writing it down in a different font. Use a password hash (see Hashing & checksums) for secrets.

Common variants

Variant	Difference
Standard	Alphabet `+/`, pad `=`.
URL-safe	Uses `-_` instead of `+/` so it is safe in URLs/paths (no padding issues).
Base32 / Base58	Used where case-insensitivity or human-typing matters (e.g. Bitcoin addresses use Base58).

FAQ

Is Base64 encryption?

No. It is a reversible encoding with no key. Anyone can decode it instantly.

Why is my Base64 string padded with =?

Padding makes the length a multiple of 4. It is required by the spec but some parsers accept it without padding.

How much bigger does my data get?

Roughly 33% (4 output chars per 3 input bytes).

URL encoding (percent-encoding) UTF-8 and character sets Checksums & verifying files

Last refreshed 2026-09-17.

Base64 encoding

What Base64 is

How the encoding works

Where you actually see it

Common variants

FAQ

Related