Guide

What Is Base64 Encoding? A Plain-English Guide (With Examples)

📅 September 2026⏱️ 6 min read

Base64 is everywhere in web development — in image URLs, email attachments, and auth tokens — but the name alone doesn't explain what it does or why it exists. Here's a plain-English breakdown, with a worked example.

Why Base64 Exists

Computers ultimately store everything — text, images, audio, encrypted keys — as raw binary bytes. The problem is that a lot of systems in the real world were built to reliably carry text, not arbitrary binary. Older email protocols guarantee delivery of 7-bit ASCII characters but can mangle raw binary bytes in transit. JSON and XML documents are text formats with no native way to embed a binary blob. URLs and many APIs expect readable characters, not arbitrary byte sequences that might contain control characters or invalid encodings.

Base64 solves this by converting any sequence of bytes into a string made up of only 64 safe, printable ASCII characters. Once your data is Base64 text, it can pass through any of those text-only systems without corruption — the receiving end just decodes it back to the original bytes.

The 64-Character Alphabet

Base64 gets its name from its alphabet of exactly 64 characters: uppercase letters A–Z (26), lowercase letters a–z (26), digits 0–9 (10), plus two more symbols — typically + and / — bringing the total to 64. Because 64 is a power of two (2⁶), each character can represent exactly 6 bits of data. The encoder takes your input 3 bytes (24 bits) at a time and repackages those 24 bits into 4 Base64 characters (4 × 6 bits = 24 bits) — which is also why Base64 output is always about 4/3 the size of the original input, roughly a 33% size increase.

Padding With `=`

Since Base64 processes input in 3-byte chunks, what happens when the input length isn't a clean multiple of 3? The encoder pads the final group with one or two = characters to signal "these last bits are padding, not data." You'll see a single = when the input has one extra byte left over, and == when it has two. A Base64 string with no trailing = means the original input length was already a multiple of 3.

Worked Example: Encoding "Hello"

Let's encode the 5-character string Hello step by step:

Get the byte values (ASCII): H=72, e=101, l=108, l=108, o=111
Convert to binary and group into 3-byte (24-bit) chunks: 01001000 01100101 01101100 (bytes for "Hel") and 01101100 01101111 (bytes for "lo" — only 2 bytes left, so this group gets padded)
Split each 24-bit chunk into four 6-bit groups and look up each 6-bit value in the Base64 alphabet table.
Result: Hello encodes to SGVsbG8=

Notice the single trailing = — that's because "Hello" is 5 bytes, which isn't a multiple of 3, so the last group needed one padding character. You can verify this instantly with the Base64 Encoder/Decoder — paste in "Hello" and hit Encode.

Common Real-World Uses

Data URIs: Small images embedded directly in HTML or CSS as data:image/png;base64,iVBORw0KG..., avoiding a separate HTTP request.
Email attachments (MIME): Email's MIME standard Base64-encodes attachments and non-ASCII message content so they survive transport through mail servers.
JWT (JSON Web Tokens): The header and payload segments of a JWT are JSON objects, Base64URL-encoded and joined with dots — header.payload.signature.
HTTP Basic Auth: The Authorization: Basic ... header Base64-encodes the username:password pair (this is why Basic Auth requires HTTPS — Base64 is trivially reversible).

⚠️ Base64 is NOT encryption

This is the single most important thing to understand about Base64: it provides zero security. It's a reversible text encoding, not a cipher — anyone can decode Base64 back to the original data instantly, with no key or password needed. It's also not compression; encoded output is roughly 33% larger than the input, not smaller. Never rely on Base64 alone to protect sensitive data — use real encryption (like AES) if security is the goal.

Try the Base64 Encoder/Decoder

Encode or decode Base64 instantly, with full Unicode support for emoji and any language, entirely in your browser.

Open Base64 Tool →

Frequently Asked Questions

Why does Base64 output sometimes end with = or == ?

Base64 encodes input in 3-byte groups. When the final group has only 1 or 2 bytes instead of 3, the encoder adds one or two = characters as padding so the decoder knows exactly how many bits are real data versus filler. No trailing = means the input length was an exact multiple of 3 bytes.

Does Base64 encoding compress data?

No — the opposite. Base64 output is roughly 33% larger than the original input, because each 3 bytes of input become 4 characters of output. It trades size for text-safety, not the other way around.

Can I use Base64 to hide a password or API key?

You can, but you shouldn't rely on it for security — Base64 is instantly reversible by anyone, with no secret key required. It's fine for encoding a credential into a text-only transport format (like a Basic Auth header over HTTPS), but it does nothing to protect the value itself. Use proper encryption or a secrets manager if confidentiality matters.