What Is Base64 Encoding? A Plain-English Guide

If you’ve worked with APIs, email attachments, or data URLs, you’ve seen Base64 — those long strings of letters and numbers that often end in one or two = signs. Base64 is one of the most common and most misunderstood tools in computing. This guide explains what it actually does, why it exists, and — importantly — what it is not.

The problem Base64 solves

Computers store everything as bytes, and a byte can be any value from 0 to 255. But a lot of systems were designed to handle only plain, printable text — think email, URLs, or JSON. If you try to stuff raw binary data (like an image) through one of those text-only channels, some of those byte values get mangled or interpreted as control characters, and your data arrives corrupted.

Base64 fixes this by re-encoding any data using only 64 safe characters: A–Z, a–z, 0–9, plus + and /. The result is guaranteed to survive any text-based transport untouched.

How it works (the short version)

Base64 takes your data 3 bytes (24 bits) at a time and re-slices those 24 bits into four 6-bit chunks. Each 6-bit chunk (a value from 0 to 63) maps to one of the 64 characters. Because it turns every 3 bytes into 4 characters, Base64 output is always about 33% larger than the input — that’s the trade-off for text-safety.

The = signs you sometimes see at the end are padding. When the input length isn’t a clean multiple of 3, Base64 pads the final group so it still produces a full set of four characters.

Text:    "Hi"
Base64:  "SGk="

Text:    "Hello"
Base64:  "SGVsbG8="

You can try this both ways with the Base64 Encoder / Decoder — type text to encode it, or paste a Base64 string to decode it back.

Where you’ll run into it

• Data URLs — small images embedded directly in HTML or CSS as data:image/png;base64,… so they load without a separate request.
• JSON Web Tokens (JWTs) — the header and payload of a JWT are Base64URL-encoded (a URL-safe variant that swaps + and / for - and _).
• Email attachments — MIME uses Base64 to send binary files through a text-based protocol.
• Basic authentication — HTTP Basic Auth encodes user:password in Base64.

The most important thing: Base64 is not encryption

This is the mistake that matters. Base64 is reversible by anyone with no key and no secret — it’s just a different way of writing the same data. That Basic Auth example above is a perfect illustration: dXNlcjpwYXNz looks scrambled, but anyone can decode it instantly to user:pass.

So never use Base64 to hide passwords, tokens, or sensitive data. If something needs to be secret, it needs real encryption (or hashing, for things like passwords — see our guide on strong passwords). Base64 is for transport, not secrecy.

Encoding vs. encryption vs. hashing — a quick map

• Encoding (Base64, URL encoding): reversible by anyone, for safe transport. Not secret.
• Encryption (AES, RSA): reversible only with a key, for secrecy.
• Hashing (SHA-256, MD5): one-way, for verifying integrity or storing passwords. Try the Hash Generator.

Keep those three straight and you’ll avoid the single most common security mistake beginners make.