Skip to content
Developer GuideEncoding

Base64 Encoding and Decoding Explained

Understand how Base64 encoding and decoding work, why Base64 is not encryption, how padding and UTF-8 affect results, and when Base64URL is used.

What is Base64?

Base64 represents arbitrary bytes with text characters that survive systems designed around printable data. It is common in data URLs, MIME email parts, API payloads, certificates, and token formats.

Encoding makes binary data easier to transport through text channels, but it increases size by roughly one third and does not make the data secret.

How Base64 encoding works

The encoder reads three input bytes (24 bits), splits them into four groups of six bits, and maps each group to one of 64 characters. If fewer than three bytes remain, standard Base64 may add = padding to complete the group.

A decoder reverses that mapping. If the text has invalid characters, impossible padding, or altered data, a strict decoder should reject it instead of guessing.

Base64 encode and decode example

UTF-8 text

hello

Base64

aGVsbG8=

Use the Base64 Encoder / Decoder to reproduce the conversion locally. Choose the direction explicitly: encoding accepts text, while decoding expects Base64 input.

Base64, UTF-8, and Unicode

Base64 operates on bytes, not characters. For text such as 你好 or emoji, the application first converts the string to UTF-8 bytes and then encodes those bytes. Decoding reverses both steps.

Older browser examples using btoa directly on non-Latin text can fail because that API expects byte-like characters. A UTF-8-aware conversion avoids that mismatch.

Why Base64 is not encryption

Anyone who receives Base64 text can decode it without a key. Do not use it to protect passwords, API keys, customer information, or access tokens. Confidentiality requires an appropriate encryption design; integrity may also require a signature or authenticated encryption.

Standard Base64 versus Base64URL

Base64URL changes + to - and / to _, and padding is often omitted. JWT segments use Base64URL, so a standard Base64 decoder may need normalization. The JWT decoding guide explains how those segments fit into a token.

FAQ

Frequently asked questions

What is Base64?

Base64 is a binary-to-text encoding that represents bytes with a restricted alphabet of letters, digits, plus, slash, and optional equals-sign padding.

Is Base64 encryption?

No. Base64 is reversible encoding and provides no confidentiality, integrity, or authentication.

Why does Base64 end with one or two equals signs?

Padding fills the final four-character output group when the byte count is not divisible by three. Some protocols omit padding, so requirements depend on the format.

Can Base64 encode Unicode text?

Yes, but the text must first be converted to bytes with a character encoding such as UTF-8. Encoder and decoder must agree on that encoding.

What is Base64URL?

Base64URL replaces plus and slash with hyphen and underscore and commonly omits padding, making the output safer inside URLs and tokens.

← Back to Developer Guides