What Is Base64 Encoding and How Does It Work?
Updated October 22, 2026
Base64 is a way of writing any data, such as a picture or a file, using only 64 safe text characters. It is everywhere on the web, and it is often mistaken for encryption.
Why Base64 exists
Many systems, such as email and JSON, are made for text and can break or change raw binary data. Base64 turns the data into plain letters, numbers and a few symbols that travel safely anywhere, and the other side turns it back.
How it works
- The data is cut into groups of 3 bytes (24 bits).
- Each group is split into four pieces of 6 bits.
- Each 6-bit piece (a number from 0 to 63) is written as one character from A-Z, a-z, 0-9, + and /.
- If the data does not fill the last group, = signs are added as padding.
Examples
| Text | Base64 |
|---|---|
| Hello | SGVsbG8= |
| Hello, World! | SGVsbG8sIFdvcmxkIQ== |
Base64 is not encryption
Anyone can decode Base64 in a second, with no key. It hides nothing, so never use it to protect passwords or private data. It is only a way to carry data safely through systems that expect text.
Where you will see it
- Pictures and fonts inside web pages and CSS as data URIs (data:image/png;base64,...).
- Email attachments.
- Basic authentication headers and API tokens.
- JSON Web Tokens (JWT), which use a URL-safe version with - and _ in place of + and /.
The size cost
Because 3 bytes become 4 characters, Base64 makes data about 33% bigger. That is fine for a small icon and a poor choice for a large photo.
Frequently asked questions
What does the = at the end mean?
It is padding. Base64 works in groups of three bytes, and one or two = signs fill up the last group when the data does not divide evenly.
What is URL-safe Base64?
A variant that uses - and _ instead of + and /, and often leaves out the padding, so the text can be put in a web address or a file name without being altered.