Base64 shows up in data URIs, email attachments, JWTs, and API payloads. It looks like gibberish, but its job is simple: safely carry binary data through text-only channels. Here's how it works and when (and when not) to use it.
Key takeaways
- Base64 turns binary into text using 64 safe characters.
- It makes data about 33% larger.
- It is encoding, not encryption — anyone can decode it.
=at the end is just padding.
The problem it solves
Many systems — email, URLs, JSON — were designed for text. Send raw binary (an image, a file) through them and bytes can get mangled. Base64 re-expresses that binary using only letters, digits, +, and /, which survive any text channel intact.
How it works
Base64 takes 3 bytes (24 bits) of input and splits them into four 6-bit groups. Each 6-bit group (0–63) maps to one character in the Base64 alphabet (A–Z, a–z, 0–9, +, /). If the input isn't a multiple of 3 bytes, = padding fills the gap.
Text "Hi" → bytes 01001000 01101001
Regroup to 6 bits → 010010 000110 1001(00)
→ "SGk="Encode or decode in one click
Paste text or Base64 and convert instantly — entirely in your browser.
Open the Base64 Encoder/Decoder →Common use cases
- Data URIs — embed a small image in CSS/HTML as
data:image/png;base64,.... - Email attachments — MIME encodes files in Base64.
- JWTs — the header and payload are Base64URL-encoded.
- API payloads — send binary blobs inside JSON safely.
- Basic Auth — credentials are Base64-encoded (over HTTPS).
The biggest misconception
Base64 is not security. It has no key and hides nothing. Anyone can decode it in a second. Use real encryption (and HTTPS) to protect data — Base64 only makes binary safe to transport.
Frequently asked questions
Is Base64 encryption?
No — it's encoding with no key. Anyone can decode it instantly. Never use it to protect secrets.
Why does it make data bigger?
It represents every 3 bytes as 4 characters, so output is ~33% larger.
What is the = sign?
Padding — it fills the final group when the input isn't a multiple of three bytes.
Related tools
See our Disclaimer for how to use WorkIQ content and tools.