How Base64 Encoding Works
Enter text to encode its UTF-8 bytes as Base64. Copy the generated text for a transport format that expects Base64. Encoding preserves data in a different alphabet; it does not make confidential text unreadable to other people.
Text to Base64 Examples
The text Hi encodes to SGk=, and Hello encodes to SGVsbG8=. Unicode text is first converted to UTF-8 bytes. Preserve case in the output because uppercase and lowercase Base64 characters have different values.
Base64 Padding and the RFC 4648 Alphabet
The standard alphabet uses letters, digits, plus and slash. Padding uses equals signs when the input byte length is not a multiple of three. Base64URL substitutes different characters for plus and slash and may omit padding.
Base64 vs Encryption and Hashing
Encryption requires a key and provides confidentiality when used correctly. Hashing produces a digest that is not a reversible representation. Base64 can be decoded without a key, so it is not suitable for protecting secrets.
Where Base64 Encoding Is Used
Base64 appears in data URIs, binary fields inside JSON and email encodings. It increases byte length by roughly one third before surrounding syntax. Use the form required by the destination rather than assuming standard and URL-safe encodings are interchangeable.
More examples and technical details
How Base64 Encoding Works
Base64 solves a very specific problem: moving arbitrary bytes through a channel that only accepts printable text. The trick is to stop thinking in bytes and start thinking in 6 bit chunks. Twenty-four bits divide evenly by both 8 and 6, so the encoder reads the input three bytes at a time (24 bits), slices that block into four groups of 6 bits, and turns each group into one character from a fixed 64 character alphabet.
Because three input bytes always become four output characters, the result is exactly four thirds the original size, an increase of roughly 33 percent before padding and line breaks are counted. That overhead is the price of safe transport, and it is why you should encode only when the destination genuinely cannot carry raw bytes.
- Read the next three bytes of input, giving 24 bits.
- Split those 24 bits into four groups of 6 bits each.
- Read each 6 bit group as a number from 0 to 63.
- Look up that number in the Base64 alphabet to get one character.
- Repeat until the input runs out, then apply the padding rules.
Worked Example: Encoding "Man"
The word Man is three ASCII characters, so it forms exactly one complete 24 bit block with nothing left over. That makes it the cleanest possible demonstration.
Result: Man encodes to TWFu, three bytes in, four characters out, no padding needed.
Padding Rules Explained
Real input rarely has a length that is a multiple of three. When the final block is short, the encoder pads the remaining bits with zeros, emits the characters it can, and then appends equals signs so the output length stays a multiple of four. Decoders use that count to work out how many bytes to throw away.
You will never see three equals signs in valid Base64, because a leftover of three bytes is simply a full block. A single stray equals sign in the middle of a string is a reliable sign that two encoded values were concatenated by mistake.
Where Base64 Encoding Is Used
- Data URIs. Small icons and fonts embedded directly in CSS or HTML as data:image/png;base64,... so the browser makes no extra request.
- Email attachments. MIME uses Base64 because SMTP was designed for 7 bit text and would corrupt raw binary.
- JWT segments. The header and payload of every JSON Web Token are Base64URL encoded JSON.
- Binary fields in JSON and XML. Neither format can hold raw bytes, so image blobs and signatures travel as Base64 strings.
- PEM certificates and keys. The text between the BEGIN and END markers is Base64 encoded DER.
- HTTP Basic Authentication. The username and password pair is Base64 encoded, which is exactly why the scheme requires HTTPS.
Base64 Is Encoding, Not Encryption
The related confusion is with hashing. A hash such as SHA-256 is one way and cannot be reversed, while Base64 is fully reversible by design. Choosing the wrong one is one of the most common security mistakes in application code.
The Base64 Alphabet
Every 6 bit group produces a value between 0 and 63, and that value is looked up in the table below. RFC 4648 fixes this ordering: uppercase letters first, then lowercase, then digits, then the plus and slash characters. The padding character (=) is not part of the alphabet, it only marks the end of an incomplete group.
| Index | Char |
|---|---|
| 0 | A |
| 1 | B |
| 2 | C |
| 3 | D |
| 4 | E |
| 5 | F |
| 6 | G |
| 7 | H |
| 8 | I |
| 9 | J |
| 10 | K |
| 11 | L |
| 12 | M |
| 13 | N |
| 14 | O |
| 15 | P |
| Index | Char |
|---|---|
| 16 | Q |
| 17 | R |
| 18 | S |
| 19 | T |
| 20 | U |
| 21 | V |
| 22 | W |
| 23 | X |
| 24 | Y |
| 25 | Z |
| 26 | a |
| 27 | b |
| 28 | c |
| 29 | d |
| 30 | e |
| 31 | f |
| Index | Char |
|---|---|
| 32 | g |
| 33 | h |
| 34 | i |
| 35 | j |
| 36 | k |
| 37 | l |
| 38 | m |
| 39 | n |
| 40 | o |
| 41 | p |
| 42 | q |
| 43 | r |
| 44 | s |
| 45 | t |
| 46 | u |
| 47 | v |
| Index | Char |
|---|---|
| 48 | w |
| 49 | x |
| 50 | y |
| 51 | z |
| 52 | 0 |
| 53 | 1 |
| 54 | 2 |
| 55 | 3 |
| 56 | 4 |
| 57 | 5 |
| 58 | 6 |
| 59 | 7 |
| 60 | 8 |
| 61 | 9 |
| 62 | + |
| 63 | / |
Working on something related? Browse every free developer tool on the site, including a Base64 decoder, JSON to Base64, URL encoder, and hash generators. Everything runs entirely in your browser, so nothing you paste is ever uploaded.
Standards and references
Frequently asked questions
How do I encode text to Base64?
Type or paste text in Encode mode and copy the output.
Does Base64 support Unicode?
Yes. Unicode text is converted to UTF-8 bytes before Base64 encoding.
Why does Base64 use = padding?
Padding completes the final four-character output group when input bytes are not a multiple of three.
Is Base64 encryption?
No. Anyone with the encoded text can decode it without a key.
Is the input uploaded?
No. Input is processed in this browser tab and is not uploaded by the tool. Copy and download are actions you control; ordinary page analytics do not receive tool input.