Base64 Tools Hub

What is Base64?

Base64 is a binary-to-text encoding scheme defined in RFC 4648. It represents binary data as a string of 64 printable ASCII characters: A-Z, a-z, 0-9, +, and /. The encoding is used whenever binary data needs to be transmitted over channels that only support text, such as email (MIME attachments), HTML/CSS (data URIs for inline images), JSON (embedding binary payloads), and URLs (query parameters containing binary data).

The name "Base64" comes from the fact that it uses 64 characters from the ASCII set. These 64 characters are enough to represent any binary value using a fixed number of bits (6 bits per character). The remaining 4 characters in ASCII (=, +, / and sometimes newline) have special roles: = is padding, and + and / are part of the 64-character set.

How Base64 Works

Base64 encoding takes every 3 bytes (24 bits) of input and splits them into 4 groups of 6 bits each. Each 6-bit value (0-63) maps to one character in the Base64 alphabet:

If the input length is not a multiple of 3, padding characters (=) fill the remaining positions. One padding byte means the last group had 2 bytes of real data; two padding bytes mean 1 byte.

Base64 Is Not Encryption

This is the most common misconception about Base64. Base64 encoding does not protect your data. It does not use a key. It does not make data unreadable to anyone who encounters it. Base64 simply converts binary data to a text-safe format.

Anyone with a Base64 decoder (built into every programming language, every browser, every operating system) can reverse the encoding instantly. There is no password, no secret, no computational cost to decoding. A Base64-encoded string is as readable as the original data to anyone who knows what it is.

If you need to protect data in transit, use TLS/HTTPS. If you need to protect data at rest, use AES, RSA, or another proper encryption algorithm. Base64 is for transport safety (preventing corruption), not for security (preventing access).

Base64 Size Overhead

Base64 encoding increases data size by approximately 33%. The formula is:

encodedSize = ceil(inputSize / 3) × 4

Every 3 input bytes produce exactly 4 output characters. If the input is not a multiple of 3, padding adds characters but the output is still rounded up to the next multiple of 4.

When does the overhead matter?

For small files (icons, logos, UI sprites under 10 KB), the 33% overhead is usually worth the tradeoff because you avoid an HTTP request entirely. For larger files, the size penalty outweighs the request savings, and you are better off serving separate files with proper caching headers.

In gzip-compressed contexts (most HTTP responses), the overhead shrinks because Base64 output is highly repetitive and compresses well. A gzipped Base64 image in a CSS file is typically only 5-10% larger than the same image served as a separate file with gzip.

URL-Safe Base64

Standard Base64 uses + and / characters, which have special meaning in URLs. URL-safe Base64 (defined in RFC 4648 Section 5) replaces + with - and / with _, so the encoded string can be used directly in URLs and filenames without additional percent-encoding. This variant is used in JWTs, content hashes, and S3 bucket keys.

Base64 in Practice

Data URIs

A data URI wraps Base64 content with a MIME type so browsers can render it inline. The format is data:<mime-type>;base64,<encoded-data>. For example, data:image/png;base64,iVBOR... embeds a PNG image directly in HTML or CSS.

Email (MIME)

Email was designed for ASCII text. MIME uses Base64 to encode binary attachments (images, PDFs, executables) so they survive transit through text-only mail servers.

JSON and APIs

Some APIs accept binary payloads as Base64 strings in JSON fields. This is common for file upload endpoints, image data in REST responses, and cryptographic signatures in authentication flows.

Common Mistakes

• Using Base64 for security. It provides none. Use encryption instead.
• Base64-encoding large files for HTML. Files over 10 KB are better served as separate resources.
• Forgetting URL-safe variants. Standard Base64 breaks in URLs. Use URL-safe Base64 for web contexts.
• Assuming Base64 is reversible in all contexts. While Base64 itself is always reversible, data URIs have size limits in browsers (varies by browser, typically 2-4 MB for inline CSS).
• Not handling padding. Some systems strip the trailing = characters. Re-add them before decoding if your decoder expects padding.