How to Use Base64 Encoding (and When Not To)

Base64 turns binary data — images, files, any bytes — into plain text made of 64 safe characters. It lets you put binary data where only text is allowed, such as JSON, HTML, email and URLs.

How Base64 works

Base64 takes the input three bytes (24 bits) at a time and splits them into four 6-bit groups. Each 6-bit value (0–63) maps to a character: A–Z, a–z, 0–9, “+” and “/”. If the input length is not a multiple of three, “=” padding is added.

Example: the text Man is the bytes 77, 97, 110 → bits 010011 010110 000101 101110 → values 19, 22, 5, 46 → TWFu.

Because 3 bytes become 4 characters, Base64 output is about 33% larger than the input.

Common uses

• Data URIs: embedding small images directly in HTML or CSS, like data:image/png;base64,iVBORw0…. Create them with Image to Base64.
• Email attachments: MIME encodes attachments in Base64, wrapped at 76 characters per line.
• HTTP Basic authentication: the header Authorization: Basic dXNlcjpwYXNz is “user:pass” in Base64.
• JSON Web Tokens (JWTs): the header and payload are Base64url-encoded JSON.
• Storing small binary values in JSON APIs and configuration.

Base64 is not encryption

This is the most important point. Anyone can decode Base64 instantly; there is no key. Never use it to “hide” passwords, API keys or personal data. If you see credentials in Base64 in a config file or URL, treat them as exposed.

Standard vs URL-safe Base64

“+” and “/” have special meanings in URLs, so the URL-safe variant (Base64url) uses “-” and “_” instead and often drops the “=” padding. JWTs use Base64url. The Base64 Encoder offers both.

Encoding text correctly (UTF-8)

In JavaScript, btoa("سلام") throws an error because btoa only accepts Latin-1 characters. Text must first be converted to UTF-8 bytes. Our encoder does this automatically, so Urdu, Arabic and emoji encode correctly:

// Encode UTF-8 text to Base64 in modern JavaScript
const bytes = new TextEncoder().encode('سلام 👋');
const b64 = btoa(String.fromCharCode(...bytes));

Decoding

Paste a Base64 string into the Base64 Decoder. If the result is valid UTF-8 text, it is shown; if it is binary (such as a PDF or image), download it as a file. For images, Base64 to Image shows a preview and detects the format.

When not to use Base64

• Large images on web pages — the 33% overhead and loss of separate caching make pages slower. Inline only tiny icons (under about 10 KB).
• Security — use real encryption or hashing instead.
• Big file transfers in JSON — consider multipart uploads or direct file storage.

Found an error or have a suggestion? Contact us — see our editorial policy for how we write and update guides.