What Is Base64?
And Why It Is Not Encryption

Somewhere in your codebase there is probably a password, an API key or a token that somebody wrapped in Base64 and considered handled.

It is not handled. Base64 is not encryption, not a cipher, and not obfuscation in any sense that would slow an attacker down for a second. There is no key. There is no secret. Anyone who can see the string can read what is inside it, using a tool that is free, instant and requires no skill whatsoever.

That single misunderstanding causes a remarkable amount of real damage, so it is worth understanding exactly what Base64 is — and what it was genuinely built to do, because that part is useful.

What Base64 Actually Is

What is Base64 encoding? In one line: a way of writing binary data using only 64 text characters. That is the whole definition, and the name says it — a numbering system with 64 symbols, the way binary has 2 and hexadecimal has 16. There is nothing more to the Base64 format than that.

It exists because of a problem that sounds ancient and is not. Many systems that move data around were built to carry text, and specifically plain English text. Email is the famous one: the original mail protocols handled 7-bit ASCII and nothing else. Send raw binary through them — a photo, a PDF, a ZIP — and bytes with the high bit set were mangled, stripped or interpreted as control codes. The file arrived corrupt.

Base64 solves it by translating the binary into characters that every system on earth agrees are safe: letters, digits, and two punctuation marks. The receiver translates it back, and the bytes are bit-for-bit identical to what was sent. That is the entire purpose: getting binary safely through something that only accepts text.

The idea is standardised in RFC 4648 — the Base64 RFC, if you ever need to cite it — and it reached most people through MIME, the email attachment standard. Every attachment you have ever sent travelled as Base64.

Three Bytes Become Four Characters

The Base64 algorithm is small enough to follow by hand, and following it once makes everything else obvious. So: Base64 — how does it work, from the bottom up?

A byte is 8 bits. Base64 has 64 symbols, and 64 is 2⁶, so one Base64 character carries exactly 6 bits. Eight and six have a lowest common multiple of 24 — so the encoder takes three bytes at a time (24 bits) and re-slices those same 24 bits into four groups of 6. Each group becomes one character.

Take the word Man:

So Man becomes TWFu. Nothing was added, nothing was removed, and nothing was scrambled — the identical 24 bits were simply written down in a different alphabet. That tiny Base64 example is also the clearest demonstration of why it cannot protect anything: the original bits are still right there, in order.

Here is a longer Base64 sample — a real Base64 encoded string, and a Base64 string example you can check yourself:

The 64 Characters, and the 65th

The Base64 alphabet is fixed and short. Here is the complete Base64 characters list — the entire Base64 character set it can ever produce:

Twenty-six uppercase and twenty-six lowercase Base64 letters, ten Base64 numbers and two symbols — those are all the Base64 characters there are, and no others can ever appear. There is one more you will see constantly which is not one of the 64: the equals sign. = is padding. Because the encoder works in blocks of three bytes, an input that is not a multiple of three leaves a partial block, and = pads the output up to a multiple of four characters so the decoder knows how many real bytes to expect.

That is also why the Base64 length of any encoded string is always divisible by four, and why a trailing = or == is such a reliable giveaway that you are looking at Base64 rather than a random-looking token.

Base64 Is Not Encryption

This is the part that matters, so let us be blunt about it.

People search for Base64 decrypt, for Base64 encryption, for Base64 encryption online. Those things do not exist. So what is Base64 encryption? It is a phrase with nothing behind it — you cannot decrypt Base64 for the same reason you cannot unlock a door that was never locked.

The difference is not subtle:

Here is what “protecting” a password with Base64 looks like in practice. This is HTTP Basic authentication, which is exactly this and nothing more:

Paste that string into any Base64 decoder and admin:hunter2 comes straight back out. That is why Base64 basic auth is only ever acceptable over HTTPS: the encryption comes entirely from TLS, and the Base64 contributes nothing at all. A Base64 username password pair in a header is a formatting convention, not a security measure, and Base64 authentication is not a category of authentication — it is just how the credentials are spelled. Anything sold as a Base64 password encoder is doing this and only this.

Base64 obfuscation is the same story wearing a different hat. Malware and Base64 XSS payloads are routinely encoded this way to slip past filters that only pattern-match plain text — but that fools the filter, not the analyst. Security tooling raises Base64 high entropy string warnings precisely because a long run of mixed-case letters and digits is so recognisable.

Every JWT You Have Seen Is Base64

If you want proof that Base64 hides nothing, the best example is sitting in your own browser right now.

A JWT has three parts separated by dots: header, payload and signature. The first two are Base64 — plain, ordinary Base64 with nothing else applied. Which means the payload of every token you hold is readable by anyone who has the token, including the user, including a browser extension, including anyone who ever sees a log file it landed in.

The signature does not change that. A signature proves the token was not modified and came from who it claims to; it does not make the contents private. Those are different jobs, and mixing them up is how internal user IDs, email addresses, role names and occasionally far worse end up sitting in plain view.

Try it: take any token from your own application and drop it into the JWT Decoder. It needs no key and no password, because there is nothing to unlock. Whatever you see is what everybody sees.

Why It Makes Everything 33% Bigger

Base64 has a cost, and it is a predictable one. Every three bytes become four characters, so the output is ⁴⁄₃ of the input — 33% larger, near enough exactly.

Encode one megabyte and you get 1,398,104 characters, which is 33.33% more than you started with. That is not an estimate; it falls straight out of the three-to-four rule, so every Base64 size calculator and Base64 length calculator is really just doing this multiplication:

This kills a common assumption: Base64 compression is not a thing. It is the exact opposite. Nothing gets smaller, ever, and the Base64 overhead is the price of admission. If a file needs to be smaller, that is a job for gzip, or for an Image Compressor if it is a picture — and note the order matters, because compressing already-encoded Base64 works far less well than encoding data that was compressed first.

The overhead is also why inlining large images as Base64 data URIs is usually a mistake. A 200 KB photo becomes 267 KB of characters that sit inside your HTML or CSS, cannot be cached separately from the page, and must be re-downloaded every time that page changes.

How to Recognise Base64 — and Read It

Once you know what Base64 looks like, you start seeing it everywhere: long runs of mixed-case letters and digits, no spaces, occasionally ending in one or two equals signs.

What is genuinely useful is that the start of the string tells you what kind of file is inside, because every format begins with fixed bytes and those fixed bytes always encode to the same prefix:

A Base64 image normally arrives as a data URI, which is the encoded string with a short header telling the browser how to read it. This is a real Base64 image example — a Base64 image sample shortened in the middle:

That prefix is what data:image/png;base64, is doing at the front of a string: it names the type, so the browser knows how to draw what follows. Seeing iVBORw0KGgo after it tells you the file is a PNG before you decode anything. A Base64 PDF example works the same way — any Base64 PDF sample starts JVBERi0, because every PDF file begins with the characters %PDF-.

To go in either direction there is Encode to Base64 and Decode from Base64 for text, and Image to Base64 when you need a data URI for an icon or a small graphic.

URL-Safe Base64

Two of the 64 characters cause trouble in the one place people most want to put encoded data: a URL. + means a space in a query string, and / separates path segments. Put standard Base64 in a link and it breaks or gets mangled by whatever parses it next.

So RFC 4648 defines a second variant. What is base64url? It is the same encoding with two characters swapped, and it is what people mean by Base64 URL encoding:

Here is a Base64 URL example: the same two bytes encode as +/8= in standard Base64 and -_8= in the URL-safe variant. Everything else — the alphabet, the three-to-four rule, the 33% overhead — is unchanged, and base64url encoding commonly ships with no padding at all, since the length is recoverable without it. JWTs use base64url, which is why tokens contain dashes and underscores but never a slash. If a decoder rejects a token, a leftover + or / is worth checking before anything else.

When to Use It, and What to Use Instead

Base64 has real jobs and it is very good at all of them. This list is what Base64 encoding is used for, and it answers what is the purpose of Base64 encoding better than any definition can:

• Email attachments. The original purpose, and still how every attachment travels.
• Binary inside JSON or XML. Both are text formats with no way to hold raw bytes, so a file field becomes a Base64 string.
• Small data URIs. Inlining a tiny icon or an SVG saves an HTTP request. Small being the operative word.
• Text-only storage. Database columns, config files, logs and clipboard transfers that would corrupt raw binary.
• Certificates and keys in PEM files. That block between BEGIN and END is Base64.

And where people reach for it wrongly, with the Base64 alternatives that actually do the job:

One more comparison worth settling, because it comes up constantly: Base64 vs UTF-8 is not a choice between two options. UTF-8 is a character encoding — it turns text into bytes. Base64 turns bytes into text. They point in opposite directions and are frequently used together: text becomes bytes via UTF-8, then those bytes become a safe string via Base64.

Quick Answers

What is Base64 in simple terms?

A way of writing any data using only 64 safe text characters, so it can travel through systems that only handle text. What Base64 means is exactly what the name says: a base-64 numbering system, the way binary is base-2.

What does Base64 do, and what is it used for?

It converts binary into text and back again with nothing lost. What is Base64 encoding used for: email attachments, files inside JSON, images inline in CSS, keys in PEM files — anywhere binary has to cross a channel that only carries text. So what is the point of Base64 encoding? Transport rather than secrecy — that is the whole benefit of it. It is never for hiding anything.

What is Base64 format?

There is no separate file type here: the Base64 format means data written in those 64 characters, nothing more. TWFu is a complete Base64 format example — three bytes in, four characters out.

Can you decrypt Base64?

There is nothing to decrypt. Base64 encryption does not exist as a thing — it is an encoding, so it is decoded, and decoding needs no key, no password and no permission. Anyone holding the string can read what is in it.

Is Base64 safe for passwords?

No, and this is the single most damaging assumption about it. Asked as the exam question — what is a characteristic of Base64 encoding regarding passwords — the answer is that it provides no protection at all. A Base64 password is a plaintext password written differently, and a Base64 username and password in a header is readable by anyone who sees the request. Store passwords as one-way hashes and keep secrets out of anything that gets encoded rather than encrypted.

What is a Base64 string, and what does Base64 look like?

Letters and digits with no spaces, in a run whose length is a multiple of four, often ending in one or two equals signs. SGVsbG8sIFdvcmxkIQ== is a Base64 string sample, and it says Hello, World! What is a Base64 encoded string, in the end? Exactly that. And what is Base64 encoded data? The same answer: ordinary bytes, spelled in 64 characters. If it starts iVBORw0KGgo it is a PNG; /9j/ is a JPEG; JVBERi0 is a PDF.

How long is a Base64 string?

Four characters for every three bytes, rounded up to the next multiple of four. There is no Base64 max length in the format itself — the limits come from whatever carries it, such as a URL length cap or a database column.

What is a Base64 image, and what is a Base64 file?

Both are ordinary binary — a picture, a document, an archive — written out as text so it can sit inside HTML, CSS or JSON instead of living as a separate file. There is no such thing as a Base64 image format or a Base64 file type: the format is whatever it was before encoding, and decoding gives that file back byte for byte, about a third larger along the way.

What is the difference between Base64 and binary?

Binary is the data itself. Base64 is one way of writing that data down using text characters. Decoding gives the identical binary back, which is why the round trip never loses anything.

What is Base64 decode, and how do you do it?

Decoding reverses the three-to-four rule and hands back the original bytes, and a Base64 binary decode is the same operation named from the other end. The answer to Base64 how to decode is one step: paste the string into a decoder. So what is a Base64 decoder? A converter, not a cracker — there is nothing to crack.

What is Base64 URL encoding?

Base64 URL encoding is the base64url variant, which replaces + with - and / with _, usually with Base64 no padding on the end, so the string survives being put in a link. JWTs use it.

What does Base64 mean, and what is Base64 code?

The name means base-64: a numbering system with 64 symbols. The Base64 encode meaning is simply converting bytes into those symbols, and Base64 code is the resulting text — not program code.

Does Base64 compress data?

No — it expands it by about a third. If you need both, compress first and encode second, never the other way round.

So: Base64 is a translation, not a lock. It exists so binary can travel through text-only pipes, it costs 33% in size, and it protects nothing at all. Use it for what it is genuinely excellent at, and the moment the question becomes “can someone read this?”, reach for encryption or a hash instead.