Base64 Encoder & Decoder: What It Is, How It Works, and When to Use It

Base64 is a way to represent binary data as plain text using 64 ASCII characters: A–Z, a–z, 0–9, plus + and /. It lets binary like images, keys, and email attachments travel safely through systems built for text. It is encoding, not encryption.

Base64 uses a fixed alphabet of 64 characters. Each value from 0 to 63 maps to exactly one of them, which is how any 3 bytes of binary become 4 readable characters:

The = sign is the one exception. It is padding, not one of the 64 values, and only rounds out the last block.

You have almost certainly seen it already. Base64 shows up wherever binary needs to ride inside text:

That data-URI trick looks like this. The long string is the entire image:

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" alt="Red dot" />

Why does Base64 exist?

Early network protocols were built for text, not raw bytes. ASCII used 7 bits and 128 characters, which was fine for English but not for binary. Some systems mangled control characters or rewrote line endings (LF to CR + LF), quietly corrupting images and audio in transit.

Base64 sidesteps all of that by only ever emitting characters every system already agrees on. Base16 and Base32 do the same job with smaller alphabets, but Base64 packs more data per character while staying safe. That is why it won.

How Base64 encoding works

The whole scheme is one idea on repeat: take 3 bytes (24 bits), re-slice them into four 6-bit groups, and look each group up in the alphabet. Here is the word "Logto", encoded by hand.

Step 1. Turn each character into its 8-bit binary:

Step 2. Take the first three bytes, "Log", and re-slice those same 24 bits into four 6-bit groups:

Step 3. Read each 6-bit group as a number, then look the number up in the alphabet:

"Logto" is 5 bytes, not a multiple of 3. The last two bytes, "to", leave a 6 + 6 + 4 split. Pad those last 4 bits with zeros to fill a 6-bit group, then add one = to complete the 4-character block.

Put the blocks together: "Logto" → TG9ndG8=

Every language ships this built in. In Node.js:

const text = 'Logto';
const base64 = Buffer.from(text).toString('base64');
console.log(base64); // TG9ndG8=

Three rules fall out of that process, worth keeping in mind:

Sources:

When should you use Base64?

Reach for Base64 when binary has to pass through a text-only channel:

What you get in return:

URL-safe Base64 (Base64URL)

Standard Base64 leans on three characters that clash with how URLs, query strings, and filenames work: +, /, and the = padding. Drop a normal Base64 string into a link and it can break in quiet ways:

You can percent-encode them (+ becomes %2B, / becomes %2F, = becomes %3D), but that bloats the string and is easy to double-encode by mistake.

Base64URL (RFC 4648 §5) fixes this at the source: swap + for -, swap / for _, and drop the = padding. The result drops straight into a URL, query parameter, or filename with nothing to escape. You will see it in URLs, filenames, and many web APIs.

const base64 = 'TG9ndG8=';
const urlSafe = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
console.log(urlSafe); // TG9ndG8

Limitations (and one big misconception)

Base64 is a representation, not a free lunch. Keep three things in mind:

Base64 is not encryption. This is the mistake people make most. Base64 hides nothing. Anyone can decode it in one line. If the data is sensitive, encrypt it. Base64 only changes the shape, never who can read it.

Frequently asked questions

Is Base64 encryption or secure?

Why is my Base64 string about 33% larger?

What do the = signs at the end mean?

What is the difference between Base64 and Base64URL?

Can Base64 encode any file, or just text?

Does this tool send my data anywhere?