What Is Base64 Encoding? A Plain-English Guide

If you’ve seen a long string like SGVsbG8sIHdvcmxkIQ== in an API response, an email source or a web page, you’ve met Base64. It’s a way to write any data, including images and files, using only plain letters, digits and a couple of symbols.

Why it exists

Many systems were built to carry text, not raw bytes. Email, JSON, URLs and HTML all have characters with special meaning, and some old systems mangle anything that isn’t basic ASCII. Base64 sidesteps this by using just 64 characters that are safe almost everywhere: A–Z, a–z, 0–9, + and /, with = for padding.

How it works

Computers store data as bytes of 8 bits. Base64 takes 3 bytes (24 bits) at a time and splits them into four groups of 6 bits. Each 6-bit group is a number from 0 to 63, which picks one of the 64 characters. Here’s the word “Man”:

When the input isn’t a multiple of 3 bytes, the output is padded with one or two = signs so its length stays a multiple of 4. That’s why so many Base64 strings end in = or ==.

You can try this yourself with Base64 Encode and Base64 Decode.

Why Base64 makes data bigger

Every 3 bytes become 4 characters, so encoded data is about 33% larger than the original. A 30 KB image becomes about 40 KB of Base64 text. That overhead is the main reason not to Base64-encode large files.

Where you’ll see it

• Data URIs: small images embedded directly in HTML or CSS, like data:image/png;base64,iVBOR…. Create them with Image to Base64 and turn them back into files with Base64 to Image.
• Email attachments: MIME encodes attachments as Base64 so they survive mail servers.
• JSON Web Tokens: each part of a JWT is Base64URL-encoded JSON. Paste one into the JWT Decoder to read it.
• HTTP Basic authentication: the username and password are joined with a colon and Base64-encoded in the request header.
• APIs: files are often sent inside JSON as Base64 strings.

Base64URL

The + and / characters have special meanings in URLs. The URL-safe variant swaps them for - and _ and usually drops the padding. JWTs and many web tokens use it. Our decoder accepts both forms automatically.

Base64 is not encryption

This is the most important point. Anyone can decode Base64 instantly; there’s no key or secret. It hides data from nobody. Never use it to protect passwords, API keys or personal data. If you need secrecy, use real encryption; if you need to check a file hasn’t changed, use a hash from the Hash Generator (MD5, SHA-256).