Base64 Encoder & Decoder

What Is Base64 Encoding?

Base64 is a binary-to-text encoding scheme that represents binary data using a set of 64 ASCII characters. The alphabet consists of uppercase letters (A-Z, indices 0-25), lowercase letters (a-z, indices 26-51), digits (0-9, indices 52-61), and two additional characters: plus (+, index 62) and forward slash (/, index 63). The equals sign (=) serves as padding when the input length is not a multiple of three bytes.

The encoding process works by taking three bytes (24 bits) of binary input and splitting them into four groups of 6 bits each. Each 6-bit group (value 0-63) maps to one character in the Base64 alphabet. Because 6 bits per character is less than the 8 bits per byte in the original data, the encoded output is always larger: precisely 4/3 the size of the input (a 33% increase). A 1 MB file produces approximately 1.33 MB of Base64 text.

Base64 is emphatically not encryption. It provides zero security. Anyone can decode a Base64 string instantly with any freely available tool or a single line of code. It should never be used to protect sensitive information. Its purpose is purely transport encoding: safely representing binary data in contexts that only support text. This tool is part of our binary converters collection.

RFC 4648: The Base64 Specification

The formal specification for Base64 encoding is RFC 4648, published in October 2006. It defines the standard Base64 alphabet, the Base64url variant, padding rules, and line-length considerations. The standard alphabet uses + and / as the 62nd and 63rd characters, but these have special meaning in URLs (+ represents a space in form data, / is a path separator) and filenames.

The Base64url variant replaces + with - and / with _, producing output safe for use in URLs, cookies, filename, and HTTP headers without additional percent-encoding. Padding with = characters ensures the output length is always a multiple of 4. Some implementations omit padding when the application can independently determine the input length.

Data URIs and Embedded Content

Data URIs allow binary content to be embedded directly in HTML, CSS, and JavaScript using the format data:[mediatype];base64,[data]. A small PNG icon can be included as an <img> tag's src attribute without requiring a separate HTTP request. CSS background images, SVG content, and small font files are also common candidates for data URI embedding.

The primary benefit is reducing HTTP requests. For assets under 2-3 KB, the overhead of an HTTP request (DNS resolution, TCP handshake, TLS negotiation, HTTP headers) far exceeds the asset's actual size. Embedding these as data URIs eliminates this overhead at the cost of the 33% Base64 size increase and the loss of separate browser caching for the individual asset.

For assets larger than a few kilobytes, the tradeoff reverses: the Base64 overhead and inability to cache separately make external files more efficient. Modern HTTP/2 and HTTP/3 protocols with multiplexed streams also reduce the per-request overhead, further narrowing the use case for data URIs.

Email Attachments and MIME

The MIME (Multipurpose Internet Mail Extensions) standard uses Base64 as the primary encoding for email attachments. Email protocols like SMTP were designed for 7-bit ASCII text and cannot safely transmit raw binary data. Base64 converts binary attachments -- images, PDFs, documents, archives -- into ASCII text that passes through email servers without corruption.

The Content-Transfer-Encoding: base64 header in a MIME part signals that the body is Base64-encoded. Email clients decode this automatically, so users never see the Base64 representation. Inline images in HTML emails use the same mechanism, embedded as MIME parts referenced by Content-ID headers. For more on the browser APIs, see the MDN documentation on btoa().

JWT Tokens and Base64url

JSON Web Tokens (JWTs) are a cornerstone of modern web authentication. A JWT consists of three Base64url-encoded sections separated by dots: a header (algorithm and type), a payload (claims about the user), and a signature (cryptographic verification). The header and payload are JSON objects encoded with Base64url (not standard Base64) to produce URL-safe strings.

Decoding the header and payload with a Base64url decoder reveals their JSON content in readable form, which is invaluable for debugging authentication issues. However, this also means JWTs are not confidential: anyone who obtains a JWT can read its payload. The signature section prevents tampering but does not encrypt the content. For confidentiality, use JWE (JSON Web Encryption) rather than plain JWTs.

Performance Considerations

The 33% size increase from Base64 encoding has direct implications for performance. In HTML documents, Base64-encoded assets are not cached separately from the page. In API responses, Base64 binary data increases payload sizes and JSON parse times. For performance-critical applications, returning URLs to binary resources is generally more efficient than embedding Base64 data inline.

Browser-based encoding/decoding with btoa() and atob() is efficient for small to moderate data sizes. For large files (several megabytes), use the FileReader.readAsDataURL() API for encoding, which handles memory more efficiently than processing the entire file as a string. Our tool uses FileReader for file uploads, ensuring smooth handling of large files.

Frequently Asked Questions

What is Base64 encoding?

Base64 is a binary-to-text encoding scheme that represents binary data using 64 ASCII characters (A-Z, a-z, 0-9, +, /). It is used to embed binary data in text-based formats like email, JSON, HTML data URIs, and JWT tokens.

Why does Base64 increase file size?

Base64 converts every 3 bytes of binary input into 4 characters of text output. This 4:3 ratio means the encoded output is approximately 33% larger than the original. The overhead is the cost of representing 8-bit binary data in a 6-bit-per-character text format.

What is a data URI?

A data URI embeds file content directly in HTML or CSS using the syntax data:[MIME-type];base64,[encoded-data]. It eliminates an HTTP request for the resource but increases the document size by the Base64 encoding overhead.

What is URL-safe Base64?

URL-safe Base64 (Base64url) replaces the + and / characters with - and _ respectively, and typically omits padding. This variant is safe for use in URLs, query parameters, cookies, and filenames without additional encoding.

Is Base64 encryption?

Absolutely not. Base64 is a reversible encoding, not encryption. It provides zero security or confidentiality. Anyone can decode a Base64 string instantly. Never use Base64 to protect sensitive data. Use proper encryption (AES, RSA) for security.

What are JWTs and how do they use Base64?

JSON Web Tokens consist of three Base64url-encoded parts separated by dots: a header (specifying the signing algorithm), a payload (containing claims like user ID and expiration), and a signature. The first two parts can be decoded by anyone to read the token's contents.

Can I encode files to Base64?

Yes. Our tool supports drag-and-drop file upload. Drop any file onto the upload zone to encode it as a Base64 data URI. Image files will show a preview. The output includes the complete data URI with automatic MIME type detection.