You've probably seen a long string of seemingly random letters and numbers in an email header, a CSS file, or a JSON web token. There's a good chance it was Base64. It's one of the most common ways to move binary data through systems that only expect plain text — and one of the most misunderstood.
What Base64 actually does
Base64 represents binary data using just 64 ASCII characters: the uppercase letters A–Z, lowercase a–z, the digits 0–9, and the two symbols + and /. An = is sometimes added at the end as padding.
It works by taking three bytes (24 bits) of data and splitting them into four 6-bit groups, since 2 to the 6th power is exactly 64. Each 6-bit group becomes one of those 64 characters. Because four output characters represent three input bytes, the encoded result is about 33% larger than the original data.
For example, the text Hi encodes to SGk= — the trailing = pads out the final group.
Why it exists
Many older protocols were built to handle text, not raw binary, and would corrupt or choke on certain byte values. Base64 sidesteps that by guaranteeing every character is safe to transmit. Common uses include:
- Email attachments, via the MIME standard, so images survive text-only mail transport.
- Data URLs, like
data:image/png;base64,..., which embed images directly in HTML or CSS. - JSON Web Tokens (JWTs) and API payloads that need to carry binary safely inside text fields.
The big misconception: it is NOT encryption
This is the most important thing to understand: Base64 is encoding, not encryption. It scrambles nothing and hides nothing. Anyone can decode a Base64 string back to the original instantly — there's no key, no password, no security at all.
If you need to protect sensitive data, you need real encryption (like AES) on top. Treat Base64 only as a transport format, never as a way to keep secrets. A password stored as Base64 is effectively stored in plain text.
| Property | Base64 | Encryption |
|---|---|---|
| Reversible without a key | Yes | No |
| Provides security | No | Yes |
| Purpose | Safe transport | Confidentiality |
How to use it
To try it yourself, the Base64 Encode / Decode tool converts text to Base64 and back instantly. It's UTF-8 safe and runs entirely in your browser, so nothing you paste is ever sent to a server — handy when you're inspecting tokens or building data URLs.
Base64 is built on the same positional-value ideas as other number systems, so if the 6-bit grouping intrigues you, the Number Base Converter is a great companion for seeing how binary maps to other bases. And when you need a unique identifier rather than encoded data, the UUID Generator produces collision-resistant IDs in one click.