Base64 Encode/Decode

What Base64 is for

Base64 is an encoding that represents binary data using 64 printable ASCII characters (A-Z, a-z, 0-9, plus + and /). It exists so binary bytes can travel through channels that only reliably handle text: email bodies, JSON string fields, URL parameters, HTML data attributes, and HTTP headers. It is an encoding, not encryption. Anyone can decode it, so it provides no secrecy at all.

The size cost

Base64 turns every 3 bytes into 4 characters, so encoded output is about 33 percent larger than the original. A 300 KB image becomes roughly 400 KB once inlined as a data URI. That tradeoff is worth it for small assets that avoid an extra network request, but it is wasteful for large files.

Example

"Man" -> "TWFu"
"Ma"  -> "TWE="
"M"   -> "TQ=="

The = characters are padding. They fill out the final group when the input length is not a multiple of 3, which is why you often see one or two equals signs at the end.

Standard vs URL-safe

Plain Base64 uses + and /, which have special meaning in URLs. The URL-safe variant substitutes - and _ and often drops padding. If you are putting a token in a query string, decoding with the wrong variant is a frequent source of corruption. Related: see the URL encoder for the other half of safely moving data through URLs.

FAQ

Is Base64 safe to store passwords in? No. It is trivially reversible. For secrets you need hashing with a hash function or real encryption.

Why does my decoded text look like gibberish? The bytes were probably not UTF-8 text to begin with, or the string was actually URL-safe Base64 and needs the alternate alphabet before decoding.

Can I Base64 a whole image? Yes, that produces a data URI you can embed in CSS or HTML, but remember the 33 percent size penalty and that the browser cannot cache it separately.