What Is Base64 Encoding and When Do You Need It?
Base64 turns any data into a string of sixty-four safe characters - letters, digits, plus and slash. It exists because a great many systems were built to carry text and will quietly mangle anything else. The Base64 Encoder and Decoder converts in both directions.
The problem it solves
Email, HTTP headers, JSON string values, XML, URLs: all of these are text channels. Push raw binary through one and bytes get stripped, reinterpreted or treated as control characters, and what arrives is not what left.
Base64 takes three bytes at a time and re-expresses them as four printable characters. Nothing is lost and nothing is interpreted, because every character in the output is one a text channel will carry untouched. That is the whole idea, and it explains the cost: four characters where there were three bytes, so the result is about thirty-three per cent larger than the original.
The dangerous misunderstanding
Base64 is not encryption and offers no security whatever. It is a reversible transformation with no key and no secret. Anyone can decode it instantly, and it is obvious on sight - a long run of letters and digits, often ending in one or two equals signs.
So a password, token or API key stored as Base64 is stored in plain text with an extra step. People do this surprisingly often, usually because the output looks scrambled. It is not. If you need secrecy you need encryption, and if you need to verify something without storing it you need a hash from the Hash Generator.
Where you will actually meet it
Email attachments are Base64 encoded, which is why a one megabyte photo adds about 1.37 megabytes to a message. JWT tokens are Base64 encoded JSON, which is why the JWT Decoder can read one without a key. Data URIs embed an image directly in HTML or CSS as Base64, which the Base64 Image Encoder produces. And binary fields inside JSON have to be encoded, because JSON has no binary type.
Common questions
What are the equals signs at the end?
Padding. Base64 works in blocks of three bytes, so when the input does not divide evenly the output is padded to a multiple of four characters.
Does encoding compress the data?
The opposite - it grows by a third. Compress first if size matters, then encode the compressed result.
Is Base64 safe to put in a URL?
Not standard Base64, because plus and slash have meanings in a URL. There is a URL-safe variant that uses minus and underscore instead, or you can encode the result again with the URL Encoder and Decoder.
Can I decode something if I do not know it is Base64?
Usually yes, by sight. Only the sixty-four characters appear, the length is a multiple of four, and it often ends in equals signs.
Why does the same text give me a different-looking result elsewhere?
Almost always the URL-safe variant, which swaps two characters, or a tool that wraps the output across several lines. Both decode to the same bytes.
Need to encode or decode something?