Base64 Encoding Explained: What It Is and When to Use It
Published June 9, 2026
Prepared by Innealan Editorial
Base64 is one of the most widely used encodings on the web, yet it’s often misunderstood as a form of encryption. It isn’t. It’s purely a way to represent binary data using a restricted set of printable characters.
A small encoding example
The text cat becomes Y2F0 in Base64. Three input bytes become four printable characters, drawn from a 64-character alphabet (A-Z, a-z, 0-9, +, /, with = used for padding). That makes binary data easier to carry through text-only systems such as email and JSON.
That’s also why a Base64-encoded string ends up about 33% larger than the original data. You’re trading size for compatibility.
What Base64 is not
- It is not encryption. Anyone can decode Base64 instantly; it provides zero confidentiality. Never use it to “hide” passwords, tokens, or sensitive data.
- It is not compression. It makes data larger, not smaller.
- It is not a hashing function. Base64 is reversible by design; hashes like SHA-256 are one-way.
Common real-world uses
- Embedding images in CSS/HTML via data URIs (
data:image/png;base64,...), avoiding extra HTTP requests for small icons. - Encoding binary attachments in JSON payloads, since JSON strings can’t contain raw binary bytes.
- Basic HTTP authentication headers, where credentials are Base64-encoded (again, not encrypted, so this only works safely over HTTPS).
- JWT (JSON Web Tokens), which Base64URL-encode their header and payload segments.
Base64 vs Base64URL
Standard Base64 uses + and /, which have special meaning in URLs and file paths. Base64URL is a variant that replaces them with - and _ and often omits the = padding, making it safe to use directly inside URLs. This is what JWTs use.
Do not interchange the two forms without checking the protocol. A standard Base64 decoder may reject an unpadded Base64URL value, and a value that happens to work in a browser can still fail in another implementation.
Try our Base64 Encoder / Decoder to convert text instantly, with full Unicode support, entirely in your browser.