A practical guide to Base64 encoding — what it is, how it works, common use cases like JWTs and data URIs, and when not to use it.
Base64 is a binary-to-text encoding scheme that represents binary data using 64 printable ASCII characters: A–Z, a–z, 0–9, +, and /. The name comes from the fact that it uses a 64-character alphabet.
Every group of 3 bytes (24 bits) of input data is split into four 6-bit groups. Each 6-bit value maps to one of the 64 characters. If the input length isn't divisible by 3, the output is padded with = characters.
Example: The string hello encodes to aGVsbG8=
Many systems — email (SMTP), HTTP headers, JSON, XML — were designed to carry text, not arbitrary binary data. Images, PDFs, and other binary files contain byte values that would be misinterpreted or corrupted by systems expecting ASCII text.
Base64 solves this by converting binary data into a text-safe representation. The trade-off is a ~33% size increase.
1. HTTP Basic Authentication
The Authorization header in HTTP Basic Auth is Base64-encoded:
``
Authorization: Basic dXNlcjpwYXNzd29yZA==
`
This is user:password encoded in Base64. Note: this is NOT secure on its own — always use HTTPS.
2. JWT Tokens
JSON Web Tokens consist of three Base64URL-encoded sections separated by dots:
`
header.payload.signature
`
You can decode the header and payload without any secret key. Use our Base64 to Text Decoder or the dedicated JWT Decoder to read them.
3. Data URIs (Embedding Images in CSS/HTML)
Small images and icons can be embedded directly in HTML or CSS:
`css
background-image: url('data:image/png;base64,iVBORw0KGgo...');
`
This eliminates a separate HTTP request — useful for small UI icons. Our Image to Base64 tool converts any image file to this format.
4. Encoding Binary Data in JSON or XML
JSON doesn't support raw binary. If you need to transmit a file or binary blob in a JSON API response, Base64 is the standard approach.
Standard Base64 uses + and / which are special characters in URLs. URL-safe Base64 replaces:
- + → -
- / → _`
This variant is used in JWTs, OAuth tokens, and any context where the encoded string appears in a URL.
- For encryption: Base64 is trivially reversible. If you need to secure data, use proper encryption.
- For large binary files: The ~33% overhead matters at scale. Use binary protocols or presigned URL uploads instead.
- For passwords: Store passwords with proper hashing algorithms (bcrypt, Argon2), never Base64.
|---|---|
Encode and decode Base64 directly in your browser — no data is sent to any server:
No. Base64 is encoding, not encryption. Anyone can decode Base64 without a key. It is used to safely transport binary data in text systems, not to secure it.
Larger. Base64 encodes every 3 bytes of binary data as 4 ASCII characters, increasing the size by approximately 33%.
Use URL-safe Base64 (which replaces + with - and / with _) whenever the encoded string will appear in a URL, filename, or JSON Web Token.
Yes. Image files encoded as Base64 can be embedded directly in CSS (as data: URIs) or HTML img tags, eliminating a separate HTTP request — useful for small icons.