What Is Base64? Encoding Explained in Plain English
What Base64 encoding is, why it isn't encryption, why it makes data 33% bigger, and when you should (and shouldn't) use it.
Base64 is a way of writing any data — images, files, arbitrary bytes — using only 64 ordinary text characters: A-Z, a-z, 0-9, + and /. It exists because many of the internet's channels were built for text and choke on raw binary. Base64 is not encryption, hides nothing, and makes data 33% bigger. You can try it in seconds with the Docuboxer Base64 encoder/decoder, which runs entirely in your browser.
The problem Base64 solves
Email was designed to carry text. So were URLs, JSON and XML. But we constantly need to push binary things through them: a photo attached to an email, an image embedded in a stylesheet, a signature inside a token. Feed raw bytes into a text channel and something along the way will mangle them — a byte that looks like a control character, a quote that terminates a string early.
Base64's answer is blunt but effective: re-express those bytes using only characters every text system on Earth handles safely. Three bytes of input become four characters of output, chosen from that 64-symbol alphabet. The receiving end reverses the mapping and recovers the original bytes, bit for bit.
Base64 is not encryption (this matters)
Because a Base64 string looks like gibberish — U2VjcmV0IQ==— people regularly mistake it for protection. It isn't. There is no key: the "decoding" is a fixed, public mapping that any tool reverses instantly. Treating Base64 as security leads to real incidents: credentials "hidden" in Base64 inside config files, personal data "masked" in URLs, API keys "obscured" in client-side code. All of it is plaintext to anyone who cares.
The rule of thumb: Base64 changes how data looks; encryption changes who can read it. If confidentiality matters, encrypt with a real algorithm and then — if the ciphertext must travel a text channel — Base64-encode the encrypted result. That combination is everywhere: it's how signatures travel inside JWT tokens, which are three Base64url segments you can inspect with the JWT decoder.
Why the 33% size penalty exists
Sixty-four symbols carry 6 bits of information each (2⁶ = 64). A byte has 8 bits. To represent 24 bits — three bytes — you need four Base64 characters. Output is therefore always 4/3 of input, plus up to two = padding characters to round the length to a multiple of four.
That overhead is why you shouldn't Base64 things that didn't need it. A 5 MB photo pasted into JSON as Base64 becomes 6.7 MB of payload — and unlike compression, this growth buys you nothing except text-safety. Encode when the channel demands it; never "just in case".
Where you meet Base64 every day
- Email attachments: MIME encodes every attachment as Base64 — it's why a 10 MB file pushes an email past a 12 MB limit.
- Data URIs: small images inlined directly into HTML or CSS as
data:image/png;base64,..., saving an HTTP request. Sensible for icons; wasteful for photos, because of the +33%. - JSON APIs: when a JSON payload must carry a file — a PDF, an image — it travels as a Base64 string, since JSON has no binary type.
- JWT tokens: header, payload and signature are each Base64url-encoded. Decoding the payload (no key required!) is a five-second job — and a good reminder that JWTs are signed, not secret.
- Basic auth headers:
Authorization: Basic dXNlcjpwYXNzis justuser:passBase64-encoded — which is exactly why Basic auth without HTTPS is a credential leak.
Encoding, decoding and inspecting safely
Decoding a mystery string is often the fastest way to understand a config file, a webhook payload or a token. The Base64 tool encodes and decodes both text and files, and — because everything runs locally in your browser — you can safely paste strings that might contain credentials or personal data. Nothing is transmitted; the tool works with the network disconnected.
Base64's sibling for URLs is percent-encoding, which escapes only the characters that would break a URL rather than re-encoding everything — the URL encoder/decoderhandles that one. Knowing which of the two you're looking at (percent signs vs. the 64-character alphabet) is half of debugging any mangled string.
Frequently asked questions
Is Base64 encryption?
No. Base64 has no key and no secret — anyone can decode it instantly, and free decoders are everywhere. It's a representation change, like writing a number in Roman numerals. If you need confidentiality, you need actual encryption (like AES); Base64 only makes binary data safe to carry through text channels.
Why does Base64 make data bigger?
Base64 represents every 3 bytes of input as 4 text characters, so output is 4/3 the size — a fixed +33% overhead (plus a little padding). That's the price of expressing arbitrary bytes using only 64 safe ASCII characters.
What are Base64 strings used for in practice?
Email attachments (MIME), small images inlined in CSS/HTML as data URIs, JSON payloads that must carry binary data, JWT tokens, and basic HTTP authentication headers. The common thread: a text-only channel that needs to transport binary content.
How can I recognize Base64 when I see it?
It's a block of A-Z, a-z, 0-9 plus '+' and '/', often ending in one or two '=' padding characters, with a length that's a multiple of 4. Strings like 'SGVsbG8gd29ybGQ=' are a giveaway — paste one into a decoder and you'll see the original content immediately.
What's the difference between Base64 and URL encoding?
URL encoding (percent-encoding) escapes individual reserved characters so text survives inside a URL — it only touches problem characters. Base64 re-encodes entire byte sequences into a new alphabet. For URLs there's even a Base64 variant ('base64url') that swaps '+' and '/' for '-' and '_' to avoid conflicts.
Encode or decode Base64 now
Text and files, both directions. Free, instant, and 100% local.
Open Base64 tool →Related tools
- Base64 encode/decode — Text and files, fully local.
- URL encode/decode — The sibling encoding for URLs.
- JWT decoder — See Base64url at work inside tokens.
You might also like: minify JavaScript, CSS and HTML and convert CSV to Excel without breaking your data.