What Is Base64 Encoding? A Complete Beginner's Guide

If you have ever opened a CSS file and found an image that starts with data:image/png;base64,iVBORw0KGgo..., you have already met Base64. It looks like gibberish, but it is one of the most useful and most misunderstood tools in a developer’s kit.

This guide explains what Base64 actually does, when you should reach for it, and — just as importantly — when you should not.

The problem Base64 solves

Computers store everything as bytes: numbers from 0 to 255. An image, a PDF, and a song are all just long sequences of those bytes.

The trouble is that many systems were designed to carry text, not arbitrary bytes. Email headers, URLs, XML documents, JSON strings, and older network protocols all expect readable characters. Feed raw binary into them and things break in creative ways: a byte might be interpreted as “end of message”, a line break might get rewritten, or a character might be silently mangled by a system expecting a different encoding.

Base64 is the workaround. It converts any binary data into a string made of only 64 safe, printable characters:

• A–Z (26 characters)
• a–z (26 characters)
• 0–9 (10 characters)
• + and / (2 characters)
• = is used separately, as padding

Because every one of those characters survives a trip through text-only systems intact, the data arrives exactly as it left.

How the encoding works

The name is the explanation: Base64 represents data in a base-64 number system, where each character carries 6 bits of information (2⁶ = 64).

Here is the process:

1. Take the input bytes, which are 8 bits each.
2. Line those bits up in a continuous stream.
3. Re-slice that stream into groups of 6 bits instead of 8.
4. Map each 6-bit group to one character from the 64-character alphabet.

Because 8 and 6 do not divide evenly, Base64 works on chunks of 3 bytes (24 bits) at a time, which slice neatly into exactly 4 six-bit groups. So every 3 bytes of input become 4 characters of output.

When the input length is not a multiple of 3, the last chunk is padded with = characters so the output length stays a multiple of 4. That is why so many Base64 strings end in = or ==.

The size trade-off

Turning 3 bytes into 4 characters means Base64 output is roughly 33% larger than the original data. That overhead is the price of safe transport, and it is the main reason you should not Base64-encode things carelessly. A 3 MB image becomes about 4 MB of text.

Where you will actually see Base64

Data URIs. Small images, icons, and fonts can be embedded directly in HTML or CSS as data: URIs, avoiding a separate network request. This is a genuine win for tiny assets and a mistake for large ones, since the inflated bytes block rendering of the file they live in.

Email attachments. The MIME standard uses Base64 to send binary attachments over a mail infrastructure that was designed for plain text.

HTTP Basic authentication. The browser sends Authorization: Basic dXNlcjpwYXNz — that is just user:pass in Base64. Note what this means: Basic auth offers no secrecy on its own, which is exactly why it must only be used over HTTPS.

JSON Web Tokens. A JWT is three Base64url-encoded segments separated by dots. Anyone holding the token can read the header and payload. If you want to inspect one, our JWT Decoder splits and decodes it for you.

APIs and config files. Certificates, keys, and small binary blobs are frequently passed around as Base64 because JSON and YAML cannot hold raw bytes.

The most important thing to understand: it is not encryption

This deserves its own heading because the misunderstanding is so common and so costly.

Base64 is encoding, not encryption. There is no key and no secret. The transformation is completely public and completely reversible — decoding it takes one function call and no privileged information. Anyone who can see the encoded string can read the original data.

A useful comparison:

• Encoding (Base64) changes the format so data can travel safely. Reversible by anyone.
• Encryption (AES, for example) changes the content so only a key holder can read it. Reversible only with the key.
• Hashing (SHA-256, for example) produces a fixed-length fingerprint. Not meant to be reversible at all — see our Hash Generator.

So never use Base64 to “hide” passwords, API keys, or personal data. Encoding a secret and calling it protected is one of the classic security mistakes.

Base64 vs. Base64url

Standard Base64 uses + and /, and both have special meanings inside URLs. A / looks like a path separator, and + is often interpreted as a space in query strings.

Base64url fixes this by swapping + for - and / for _, and usually dropping the = padding. This is the variant used in JWTs and in most URL-facing contexts. If a string fails to decode, a mismatch between these two variants is a very common cause.

For encoding text that goes into a query parameter rather than binary data, percent-encoding is usually the right tool instead — our URL Encoder / Decoder handles that case.

A note on Unicode

Base64 operates on bytes, not characters. Before encoding text containing emoji, accented letters, or non-Latin scripts, that text must first be converted to bytes — virtually always with UTF-8.

Skipping this step is the source of the classic “character out of range” error in JavaScript. Our Base64 Encoder / Decoder handles the UTF-8 conversion automatically, so emoji and multilingual text round-trip correctly.

Encoding and decoding in practice

You rarely need to implement Base64 yourself, since every major language ships with it:

• JavaScript (browser): btoa() and atob(), though these operate on binary strings and need a UTF-8 step for non-ASCII text.
• Node.js: Buffer.from(text).toString('base64') and Buffer.from(encoded, 'base64').toString().
• Python: the base64 module, b64encode() and b64decode().

For a quick one-off conversion, a browser tool is faster than opening a REPL. The Base64 Encoder / Decoder on MyDailyKit runs entirely on your own device, so nothing you paste is ever uploaded to a server — which matters when you are inspecting a token or a config value.

Quick answers

Why does my Base64 string end with =? Padding, added so the output length is a multiple of 4. It carries no data.

Can Base64 be decoded without a key? Yes, always. There is no key involved.

Does Base64 compress data? No — it makes data about 33% larger.

Why does my decode fail? Usually one of three things: the string uses the Base64url alphabet (- and _), the padding was stripped, or whitespace and line breaks were introduced when it was copied.

The takeaway

Base64 exists to move binary data safely through channels built for text. It is simple, universal, and completely transparent — which makes it excellent for transport and useless for secrecy. Reach for it when you need data to survive a text-only pipeline, and reach for real encryption when you need it to stay private.