How Base64 works
The input bytes are split into groups of 6 bits, and each group (0–63) is mapped to a character of the Base64 alphabet. Here is the classic example, the word “Man”:
| Text |
Man
|
|---|---|
| Bytes |
77 97 110
|
| Bits |
01001101 01100001 01101110
|
| 6-bit groups |
010011 010110 000101 101110
|
| Indexes |
19 22 5 46
|
| Base64 |
TWFu
|
When the input length isn’t a multiple of 3, the output is padded with =:
TWE= for “Ma” and TQ== for “M”.
Common uses
- Data URIs: inline small images in HTML or CSS, e.g.
src="data:image/png;base64,…". - HTTP Basic auth: the header is
Authorization: Basic base64(user:password). - JWTs: the header and payload are Base64URL-encoded JSON. Use the JWT decoder to read them.
- Kubernetes Secrets store values Base64-encoded in their
datafield. - Email attachments (MIME), with lines wrapped at 76 characters.
Base64 in code
// Browser and Node 16+
const encode = (text) => btoa(String.fromCharCode(...new TextEncoder().encode(text)));
const decode = (b64) => new TextDecoder().decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0)));
// Node.js
Buffer.from('héllo').toString('base64'); // 'aMOpbGxv'
Buffer.from('aMOpbGxv', 'base64').toString(); // 'héllo'
Buffer.from('héllo').toString('base64url'); // URL-safe
import base64
base64.b64encode("héllo".encode()).decode() # 'aMOpbGxv'
base64.b64decode("aMOpbGxv").decode() # 'héllo'
base64.urlsafe_b64encode(b"...") # URL-safe
echo -n 'hello' | base64 # aGVsbG8= (-n: don't encode the newline)
echo 'aGVsbG8=' | base64 --decode # macOS: base64 -D
base64 -i image.png # encode a file
A common mistake is echo 'hello' | base64 without -n, which encodes the trailing newline
too and gives aGVsbG8K.
Frequently asked questions
What is Base64 encoding?
Base64 represents binary data using 64 printable ASCII characters: A–Z, a–z, 0–9, + and /, with = as padding. Every 3 bytes become 4 characters, so data can travel safely through systems that only handle text, such as JSON, email, URLs and HTML.
Is Base64 encryption?
No. Base64 is an encoding, not encryption: anyone can decode it instantly without a key. Never use it to hide passwords or secrets. HTTP Basic auth and Kubernetes Secrets use Base64, which is why they must be protected by TLS and access control.
Why is Base64 output larger than the input?
Each Base64 character carries 6 bits, but takes 8 bits to store, so the output is about 33% larger (4 characters for every 3 bytes), plus up to 2 padding characters. A 1 MB image becomes about 1.33 MB of Base64 text.
What is URL-safe Base64?
Base64URL (RFC 4648 §5) replaces + with - and / with _, and usually drops the = padding, so the result can be used in URLs and filenames without escaping. JWTs use it. The decoder here accepts both alphabets automatically.
Why does atob() fail on non-English text?
JavaScript’s btoa and atob work on “binary strings” where each character is one byte, so btoa("é") or btoa("🚀") throws an error. Encode the text to UTF-8 bytes first with TextEncoder, as in the example below. This tool always uses UTF-8.