What Base64 is
Base64 is a way to write any data, including images, PDFs and other binary files, with only 64 safe characters: A to Z, a to z, 0 to 9, and two more symbols, normally + and /. It is defined in RFC 4648. It does not compress or hide anything. It only changes how the same bytes are written, so they can travel through places built for plain text.
A byte can have 256 values, and many of them are invisible control codes that older email systems and text formats could damage. Base64 takes the data 3 bytes at a time, splits those 24 bits into four groups of 6 bits, and writes each group as one of the 64 characters. The result survives copy and paste, email and JSON without a single bit changing.
Where you meet it
- Data URIs. A small image or font can sit straight in HTML or CSS as text that starts with
data:image/png;base64,followed by the Base64 of the file. - Email attachments. MIME (RFC 2045) sends attachments as Base64. The raw source of a message shows long blocks of it.
- JSON and API payloads. JSON has no type for raw bytes, so APIs often send a file, a signature or a key as a Base64 string.
- Tokens and headers. A JSON Web Token is usually three URL-safe Base64 parts joined with dots. HTTP Basic authentication sends the user name and password as Base64, which is one more reason to use it only over HTTPS.
Why the result is about 33% larger
Every 3 bytes become 4 characters, so the encoded text is four thirds of the original size: about 33% more. A 300 KB image becomes about 400 KB of Base64. Text is first turned into UTF-8 bytes. An English letter is one byte, but an accented letter or an Arabic or Urdu letter takes two, most Chinese characters take three, and an emoji takes four. So "😀" is 4 bytes and becomes 8 characters. The statistics under the result show the real numbers.
Standard and URL-safe Base64
Two characters cause trouble on the web. In a web address a + can be read as a space and a / separates the parts of the path, and / is not allowed in file names. RFC 4648 therefore also defines a URL and filename safe alphabet that uses - instead of + and _ instead of /. Choose it when the result goes into a link, a cookie or a file name. When you decode, you do not need to know which one you have: this decoder accepts both.
What the = padding means
Base64 works in groups of 4 characters. When the data does not split evenly into groups of 3 bytes, the last group is short, and one or two = signs fill it up. "f" becomes Zg== and "fo" becomes Zm8=, while "foo" fits exactly and becomes Zm9v. Some formats, such as JSON Web Tokens, leave it out, because the length already tells a decoder how many bytes are left. Switch off Add padding to match them. When decoding, missing padding is added for you.
Line wrapping: 76 and 64 characters
Some formats limit the line length. MIME email (RFC 2045) allows at most 76 characters per line, so mail programs break Base64 into lines of 76. PEM files, the text format used for certificates and keys, use lines of 64 characters between their BEGIN and END lines. For data URIs, JSON and most APIs, keep No line breaks. The decoder ignores line breaks and spaces.
Files and images
Choose a file, or drop it on the box, to encode it, and tick Output as data URI for HTML or CSS. The type comes from the first bytes of the file, so a PNG gets image/png. When you decode, common types such as PDF, ZIP, MP3 and the usual image formats are recognized and get a matching file name, and PNG, JPEG, GIF and WebP images are previewed. Other data is shown as a short hex dump. Decoded content is never run or inserted into the page, so an SVG or HTML file stays harmless text.
Base64 is not encryption
Base64 has no key and no secret. Anyone can decode it in a second, so data that only looks unreadable is not protected. Never use Base64 to hide passwords, tokens or personal data. For a password that is hard to guess, use the password generator and learn how to make a strong password you can remember.
Tips
- An error message gives the position of the first bad character. Common causes are a missing piece at the end, a stray quote mark, or two strings pasted together.
- Decoded API data is often JSON. Paste it into the JSON formatter to read it, and see the guide to fixing Unexpected token errors if it does not parse.
- To see what changed between two versions of a text, use the text compare tool.
Privacy
Everything happens in your browser. Your text and files are not uploaded, saved or tracked, and there is no sign-up. Like every page on this site, this one may show ads from third-party vendors once ads are switched on, and those vendors can use cookies. Read the privacy policy for details.