If you have ever seen a long string of random-looking characters in a JSON API response, an email header, or a data URI in CSS, you have encountered Base64 encoding. It looks like gibberish — SGVsbG8gV29ybGQ= — but it serves a very specific purpose in software development.
What Is Base64?
Base64 is a binary-to-text encoding scheme that converts binary data (files, images, any sequence of bytes) into a string of ASCII text characters. It uses 64 characters: A–Z, a–z, 0–9, +, and /, with = for padding.
The name "Base64" comes from the fact that it uses 64 different characters to represent data, compared to hexadecimal (Base16) which uses 16, or binary (Base2) which uses 2.
Why Does Base64 Exist?
Base64 was invented to solve a specific problem: many protocols and systems can only handle text, not raw binary data.
- Email (SMTP): Email was originally designed to carry only 7-bit ASCII text. Attaching a binary file (image, PDF, ZIP) required converting it to text first. Base64 is how email attachments work.
- JSON: JSON is a text format. If you need to include binary data (like an image thumbnail) inside a JSON response, you must encode it as text. Base64 is the standard choice.
- URLs: URLs can only contain specific characters. Binary data in URL parameters must be encoded.
- HTML/CSS: Data URIs (
data:image/png;base64,...) embed small images directly in HTML or CSS without separate HTTP requests.
How Base64 Encoding Works
The algorithm is straightforward:
- Take the input bytes and group them into chunks of 3 bytes (24 bits)
- Split each 24-bit chunk into four 6-bit groups
- Map each 6-bit value (0–63) to one of the 64 Base64 characters
- If the input length is not a multiple of 3, pad the output with
=characters
Example: The text "Hi" in bytes is 72 105. In binary: 01001000 01101001. Grouped into 6-bit chunks: 010010 000110 1001 + padding → Base64: SGk=
The = at the end indicates that the last group was padded to fill a complete 6-bit block.
Base64 Is NOT Encryption
This is the most common misconception. Base64 provides zero security. It is trivially reversible — anyone can decode a Base64 string instantly. Never use Base64 to "protect" passwords, tokens, or sensitive data. Use proper encryption (AES-256) or hashing (SHA-256) instead.
For hashing, you can use our Hash Generator tool.
Real-World Use Cases
- Embedding small images in CSS:
background-image: url(data:image/svg+xml;base64,PHN2Zy...);— eliminates an HTTP request for small icons. - JWT tokens: JSON Web Tokens are three Base64URL-encoded segments separated by dots.
- Email attachments: Every file you attach to an email is Base64-encoded before transmission.
- API payloads: Sending file uploads as Base64 strings in JSON request bodies.
The Size Overhead
Base64 encoding increases data size by approximately 33%. A 1 MB image becomes ~1.33 MB when Base64-encoded. This is why you should not Base64-encode large files for web embedding — use regular file URLs instead. Base64 data URIs are best for files under 10 KB.
Try encoding and decoding with our Base64 Encoder/Decoder — it runs entirely in your browser.