What is Base64 encoding used for?

Base64 is used to encode binary data (like images or files) into ASCII text so it can be safely transmitted over text-based protocols like email (MIME), HTTP headers, or embedded in JSON and XML. It is not encryption — it is just a way to represent binary data as text.

Does Base64 encoding make data secure?

No. Base64 is encoding, not encryption. Anyone can decode it instantly. Never use Base64 to hide sensitive data. If you need security, use proper encryption like AES. Base64 is purely for compatibility and transport, not confidentiality.

Why is Base64 encoded data larger than the original?

Base64 represents every 3 bytes of binary data as 4 ASCII characters, which means the output is approximately 33% larger than the input. This size increase is the trade-off for making binary data text-safe.

What is the difference between standard Base64 and URL-safe Base64?

Standard Base64 uses + and / characters which have special meaning in URLs. URL-safe Base64 replaces + with - and / with _ so the encoded string can be used in URLs and filenames without encoding issues. Use URL-safe when embedding Base64 in query parameters or JWT tokens.

Can I encode images to Base64 for use in CSS or HTML?

Yes. Encoding an image to Base64 lets you embed it directly in CSS (as a background-image data URI) or in an HTML img src attribute. This eliminates an HTTP request but increases HTML/CSS file size. It is best for small icons and logos, not large photos.

Base64 & URL Encoder/Decoder - Free Online Tool

Encode and decode Base64 and URL strings. Fast, secure, and works entirely in your browser.

Base64 & URL Encoder/Decoder

Base64 and percent-encoding are two different answers to the same problem: how do you transmit arbitrary data over a channel that only understands a limited set of characters? This reference covers both — what they do, when to use each, and the common mistakes that trip developers up.

Quick reference: Base64 vs URL encoding

Property	Base64	URL encoding (%xx)
Character set	`A-Z a-z 0-9 + / =`	Unreserved chars + `%XX` escapes
Size overhead	~33% larger than input	Varies — only special chars expand
Reversible?	Yes — trivially	Yes — trivially
Secure?	No — not encryption	No — not encryption
Main use	Binary data in text contexts	Special chars in URLs
Where you'll see it	JWT tokens, data URIs, MIME email, HTTP Basic Auth	Query strings, form POST, OAuth params

How Base64 works — the maths in plain English

Base64 takes 3 bytes (24 bits) of input at a time and splits them into 4 groups of 6 bits. Each 6-bit group maps to one of 64 printable characters — that's where the name comes from. The result is always 4 output characters for every 3 input bytes, exactly 33% larger. If the input isn't divisible by 3, padding = characters fill the gap.

Example: the string Man (3 bytes) encodes to TWFu. The string Ma (2 bytes) encodes to TWE=. The string M (1 byte) encodes to TQ== — two padding characters.

Common mistakes and how to avoid them

⚠️ Base64 is not encryption. It is trivially reversible. Never use it to protect passwords, API keys, or sensitive data in client-side code.

JWT tokens use Base64url, not standard Base64 — replaces + with - and / with _, and drops the = padding. Strip padding and swap characters before decoding a JWT with a standard decoder.
encodeURIComponent vs encodeURI — use encodeURIComponent for individual parameter values (encodes & = ? /). Use encodeURI for a full URL (preserves structural characters). Mixing them breaks query strings.
Whitespace in Base64 strings — some systems (email, PEM certificates) insert line breaks every 76 chars. If decoding fails, strip whitespace first.
Double-encoding — a common bug in API integrations. If your decoded output looks like %7B%22key%22%3A, the input was URL-encoded before being Base64-encoded.

Real-world examples

# HTTP Basic Auth header
Authorization: Basic dXNlcjpwYXNzd29yZA==

# Data URI embedded in CSS
background-image: url('data:image/png;base64,iVBORw0KGgo...');

# JWT token (three Base64url sections separated by dots)
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

# URL-encoded query string
https://example.com/search?q=hello%20world&filter=date%3A2026

All processing runs in your browser

No data is sent to any server. Your tokens, credentials, and encoded strings stay on your device.

Frequently Asked Questions

Base64 encodes binary data into ASCII text for safe transmission over text-based protocols like email (MIME), HTTP headers, or embedded in JSON and XML. It is not encryption — it is a way to represent binary data as text.

No. Base64 is encoding, not encryption. Anyone can decode it instantly. Never use Base64 to hide sensitive data. Use proper encryption like AES if you need confidentiality.

Base64 maps every 3 bytes to 4 ASCII characters — approximately 33% larger. This overhead is the trade-off for making binary data text-safe.

Standard Base64 uses + and / which have special meaning in URLs. URL-safe Base64 replaces + with - and / with _ so it can be used in URLs and JWT tokens without breaking.

Yes. Encoding an image to Base64 lets you embed it as a data URI directly in CSS or HTML, eliminating an HTTP request. Best for small icons — not large photos.

🔐 Base64 & URL Encoder/Decoder