Skip to main content

Base64 Encoder/Decoder

English

Base64

Encode or decode Base64.

All calculations performed locally in your browser. No data sent to server.

Results are for informational purposes. Verify results with other sources.

Understanding Base64

Base64 rewrites arbitrary binary data using 64 printable characters, so it can travel through channels that only accept text — email bodies, JSON strings, data: URLs, HTTP headers. It is a transport format, not a security measure.

How it works

  • Takes the input three bytes (24 bits) at a time and splits those 24 bits into four groups of six.
  • Each 6-bit group is a number from 0 to 63, used as an index into the alphabet A–Z, a–z, 0–9, + and /.
  • When the input length is not a multiple of three, the output is padded with one or two = characters so the result is always a multiple of four.
  • The URL-safe variant swaps + and / for - and _, because + and / have their own meaning inside a URL.
3 bytes (24 bits) → 4 × 6-bit groups → 4 alphabet characters
output length = 4 × ceil(input length / 3)

Worked example

Encoding the three-character string Hi! — exactly one full group, so no padding is needed.

  1. H = 0x48 = 01001000, i = 0x69 = 01101001, ! = 0x21 = 00100001
  2. concatenate: 010010000110100100100001
  3. split into six-bit groups: 010010 | 000110 | 100100 | 100001
  4. as numbers: 18, 6, 36, 33
  5. index the alphabet: 18→S, 6→G, 36→k, 33→h

Hi! encodes to SGkh. Four output characters for three input bytes — the fixed 4:3 ratio that makes Base64 about 33% larger than the data it carries.

Reading the result

  • Base64 is not encryption and offers no protection whatsoever. Anyone can decode it instantly — this page does. Never use it to hide a secret.
  • Expect roughly 33% growth, plus padding. A 10 MB file becomes about 13.3 MB once encoded, which is why inlining large images as data: URLs bloats a page.
  • The = padding carries no data. Some parsers require it, some reject it; JWT, for instance, strips it entirely.
  • Encoding is defined over bytes, not characters. Text has to be converted to bytes first, and the encoder here uses UTF-8 — the same string can produce a different result under a different character encoding.

Common questions

Is Base64 a form of encryption?
No. Encryption requires a key and is designed to resist an attacker; Base64 requires nothing and reverses in microseconds. If you found a Base64 string in a config file, treat its contents as fully public.
Why do some Base64 strings end in = or ==?
Because the input was not a multiple of three bytes. One leftover byte produces two padding characters, two leftover bytes produce one. The padding restores the output to a multiple of four.
What is base64url and when do I need it?
It is the same encoding with - and _ replacing + and /, so the output is safe inside a URL path or query string without further escaping. JWTs, OAuth parameters and many APIs use it.

Sources