How to Encode and Decode Base64, and What It’s For
By Akmal Ali · Published · Updated · 5 min read
Paste text into a Base64 encoder to turn it into Base64, or paste Base64 into a decoder to get the text back. Base64 writes any data using 64 safe characters, so it can travel through systems built for text, and makes it about a third larger. It is an encoding, not encryption: anyone can decode it.
Strings like SGVsbG8= turn up in API responses, email source, configuration files and login headers. They look scrambled, but they aren’t secret: this one simply says “Hello”. That’s Base64, and anyone who can paste it into a decoder can read it.
What is Base64 for?
Many systems were built to carry text, not raw bytes. Email, JSON, URLs, XML and HTTP headers can all break on binary data or unusual characters. Base64, defined in RFC 4648, solves this by writing any data using only 64 safe characters: A–Z, a–z, 0–9, + and /, with = for padding.
You’ll meet it in:
- Email attachments, which are sent as Base64 inside the message.
- Data URLs, such as
data:image/png;base64,…, which embed an image in HTML or CSS. - HTTP Basic authentication, where
user:passis sent asdXNlcjpwYXNz. - Tokens and API fields, such as the parts of a JSON Web Token, which use a URL-safe variant.
How does Base64 encoding work?
Base64 takes the data 3 bytes (24 bits) at a time and splits them into four groups of 6 bits. Each 6-bit group, a number from 0 to 63, picks one character.
The classic example is the word “Man”:
- As bytes: M = 01001101, a = 01100001, n = 01101110.
- Joined and split into 6-bit groups: 010011 010110 000101 101110.
- As numbers: 19, 22, 5, 46.
- As Base64 characters: T, W, F, u, giving
TWFu.
When the data isn’t a multiple of 3 bytes, the last group is padded with =:
| Text | Bytes | Base64 |
|---|---|---|
| Man | 3 | TWFu |
| Ma | 2 | TWE= |
| M | 1 | TQ== |
Because every 3 bytes become 4 characters, Base64 is about a third larger than the original data. That’s the price of making it safe to send as text.
Text, bytes and UTF-8
Base64 encodes bytes, not letters, so text is first turned into bytes, almost always as UTF-8. Letters a–z take one byte each, but é takes two and most emoji four. That’s why café becomes Y2Fmw6k= and 👋 becomes 8J+Riw==. A decoder has to use the same character encoding, or accents and emoji come back garbled.
Using the encoder
In the Base64 encoder and decoder, choose Encode or Decode and paste your input; Swap sends the result back the other way. The decoder accepts URL-safe Base64, missing padding, line breaks and a data: prefix, and tells you when the data isn’t text, such as an encoded image.
Base64 Encoder / Decoder
Convert text to Base64 and back as UTF-8, with URL-safe output and clear errors for invalid input.
Base64 in code and on the command line
- macOS and Linux:
printf 'Hi' | base64givesSGk=, andecho 'SGk=' | base64 --decodegives Hi. - Python:
base64.b64encode("café".encode())andbase64.b64decode(value).decode(). - JavaScript:
btoa()andatob()only handle characters up to code 255.btoa("café 👋")throws an error, andbtoa("café")givesY2Fm6Q==, which isn’t UTF-8. Convert the text to UTF-8 bytes withTextEncoderfirst.
URL-safe Base64
The characters + and / have special meanings in URLs and file names. The URL-safe variant replaces them with - and _, and often drops the = padding. The same three bytes that give +/+/ in standard Base64 give -_-_ in URL-safe Base64. Use it for values that go into links or file names; for other text in URLs, use percent-encoding instead, explained in how to encode and decode URLs.
Is Base64 encryption?
| Encoding (Base64) | Encryption | Hashing | |
|---|---|---|---|
| Purpose | Make data safe to send as text | Keep data secret | Check or store data without revealing it |
| Needs a key | No | Yes | No |
| Reversible | By anyone | Only with the key | No |
Anyone who sees a Base64 string can decode it in a second. The Basic authentication header above reveals the username and password to anyone who reads it, which is why it must only be sent over HTTPS. Never use Base64 to hide passwords, keys or personal data. Use encryption to protect data, and a password-hashing algorithm to store passwords.
To see the difference, encode a word to Base64 and then hash the same word in the SHA-256 Hash Generator: the Base64 decodes straight back to the word, while the hash is a fixed-length fingerprint that can’t be turned back into it.
Common mistakes
- An extra line break.
echo 'Hi' | base64givesSGkK, notSGk=, because echo adds a newline. Useprintforecho -n. - Decoding with the wrong character set, which turns é into é. Decode as UTF-8.
- Putting standard Base64 in a URL. + can be read as a space and / as a path separator. Use the URL-safe variant.
- Treating Base64 as a way to hide data. It hides nothing.
Found JSON inside a decoded value? Paste it into the JSON formatter to read it, or see how to format JSON.
Frequently Asked Questions
Can Base64 contain line breaks?
In some formats, yes: email (MIME) breaks it into lines of 76 characters, and PEM files such as certificates into lines of 64. Decoders built for those formats ignore the line breaks, and so does the VektraTool decoder.
How do I Base64-encode an image?
Use something that reads the file as bytes, such as the base64 command on a Mac or Linux, or FileReader in JavaScript. The VektraTool encoder works on text; paste Base64 into its decoder and it tells you when the data is binary, such as an image, rather than text.
Does Base64 compress data?
No, the opposite: it makes data about a third larger. If size matters, compress first, for example with gzip, and Base64-encode the compressed result when it has to travel as text.
Can I store passwords as Base64?
No. Anyone can decode Base64 instantly. Store passwords with a dedicated password-hashing algorithm, and protect other sensitive data with real encryption.