What is Base64? How it works, common uses, and key caveats

While coding or configuring a system, you have probably seen a long, cryptic string made mostly of letters and numbers, with an occasional + / =. It is probably Base64. Base64 is everywhere but frequently misunderstood. This guide explains what it is, how it works, when to use it, and one crucial fact: it is not encryption.

What exactly is Base64?

Base64 is an encoding method that turns arbitrary binary data—images, files, Unicode text, and more—into text made from 64 safe characters. Those characters are A–Z, a–z, 0–9, plus + and /, with = sometimes used as padding at the end. Its purpose is not secrecy; it lets binary data travel safely through text-only channels.

How does it work?

The principle is simple. Data is grouped into three bytes, or 24 bits, then divided into four six-bit values. Each value represents a number from 0 to 63 and maps to one of the 64 characters. Three source bytes therefore become four characters. If fewer than three bytes remain at the end, = is used as padding, which is why Base64 strings often end with one or two equals signs.

Because three bytes become four characters, Base64 output is roughly one-third larger—about 33%—than the original data. That overhead is an important tradeoff.

Common uses

• Data URLs: Embed a small icon directly in HTML or CSS as data:image/png;base64,..., avoiding a separate request.
• Email attachments: Email protocols historically transported text reliably, so MIME uses Base64 to carry attachments.
• Binary data in JSON or configuration: JSON is text-only, so images or certificates are often stored as Base64 strings.
• API parameters: Encode binary data or special characters so they can be placed safely in a URL or request body.

Important: Base64 is not encryption

This is the most common misconception. Base64 is a public, reversible transformation that anyone can decode instantly. It provides no confidentiality. Never use it to hide passwords, tokens, or sensitive information; that is effectively plain text. Use real encryption such as AES for secrecy and a hash such as SHA-256 for integrity. Base64 solves safe transport, not secrecy.

What about Unicode and emoji?

Encoding Unicode text or emoji incorrectly can produce garbled output. The text must first be converted to bytes with UTF-8, then encoded as Base64. A standards-compliant tool handles this automatically, so Chinese, Japanese, emoji, and other Unicode text round-trip correctly.

Encode and decode locally without uploads

Use the Base64 encoder and decoder to convert between text and Base64 with full Unicode and emoji support. Everything runs locally in your browser, and input is never uploaded. When working with API responses, you may also need the JSON formatter.