What is Base64 and how does it work?
Base64 is a way to write any data - text, images, PDFs, keys - using only 64 ordinary characters, so it can travel safely through systems that were built for text: e-mail, JSON, XML, HTML, CSS, URLs and HTTP headers.
Why Base64 exists
Computers store everything as bytes, values from 0 to 255. Many of those values are not printable characters, and some have special meanings: a zero byte ends a string in C, a line break ends a header in e-mail, a quote ends a value in JSON. If you put raw bytes of a photo into an e-mail or a JSON document, something along the way breaks them. Base64 solves this by turning the bytes into letters and digits that every system passes through untouched.
The 64 characters
Standard Base64 (RFC 4648) uses A-Z, a-z, 0-9, + and / - 64 characters,
so each one carries exactly 6 bits (26 = 64). The = sign is used only for padding at the end.
How 3 bytes become 4 characters
Take the word Man. Its three bytes are 77, 97 and 110:
| Text | M (77) | a (97) | n (110) | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Bits | 01001101 | 01100001 | 01101110 | |||||||||||||||||||||
| 6-bit groups | 010011 = 19 | 010110 = 22 | 000101 = 5 | 101110 = 46 | ||||||||||||||||||||
| Base64 | T | W | F | u | ||||||||||||||||||||
The 24 bits of three bytes are cut into four groups of 6 bits, and each group picks one character from the alphabet. So Man becomes
TWFu. Try it in the Base64 encoder.
Padding: the = signs
When the data length is not a multiple of 3, the last group is incomplete. One leftover byte gives two characters plus ==; two
leftover bytes give three characters plus =. Ma is TWE= and M is TQ==.
Padding makes the length a multiple of 4; most decoders, including ours, also accept data without it.
Base64 makes data about 33% bigger
Four characters for every three bytes means the encoded size is 4/3 of the original - a 300 KB image becomes about 400 KB of text, plus line breaks if they are used. That is why Base64 is great for small things (icons, keys, tokens) but wasteful for large files.
Variants you will meet
- Base64URL (RFC 4648 section 5) uses
-and_instead of+and/, usually without padding, so the text is safe in URLs and file names. JWTs use it. Convert with the Base64URL tool. - MIME Base64 (RFC 2045) breaks lines every 76 characters, as e-mail requires.
- PEM files (certificates, keys) wrap Base64 at 64 characters between
-----BEGIN ...-----lines. - Data URIs put Base64 after a media type:
data:image/png;base64,...- see data URIs explained.
Base64 is not encryption
Anyone can decode Base64 in a second - it hides nothing. Never use it to "protect" passwords or personal data. HTTP Basic authentication sends the user name and password Base64-encoded, which is why it must only be used over HTTPS.
Where Base64 is used every day
- E-mail attachments (MIME)
- Images and fonts embedded in HTML and CSS
- Files inside JSON APIs (e-signature, invoices, document storage)
- JSON Web Tokens and OAuth
- Certificates and keys (PEM)
- Binary data in XML, databases and config files
Try it
Encode or decode text with the Base64 converter, turn a picture into a data URI with Image to Base64, or get a file back with Base64 to File. And if you write code: Base64 in every language.