Base64 Encoder/Decoder

Use Base64 when transmitting binary data over text-only channels:

email attachments (MIME),

data URIs in HTML/CSS,

JSON/XML APIs requiring binary data,

HTTP Basic Authentication headers,

encoding certificates and keys,

storing binary in databases without BLOB support.

Avoid for large files (use multipart/form-data) or when encryption is needed (use proper cryptography).

No. Base64 is encoding, not encryption.

Anyone can decode it instantly.

Never use Base64 alone for sensitive data.

It provides no confidentiality, integrity, or authentication.

Use encryption (AES, RSA) for security, hashing (SHA-256) for integrity, or HMAC for authentication.

Base64 is only for data transport compatibility, not security.

What is the padding in Base64?

Base64 padding uses "=" characters to ensure output length is a multiple of 4.

Needed because Base64 encodes 3 bytes into 4 characters.

If input has 1-2 remaining bytes, padding fills the gap:

1 byte remaining = "==" padding,

2 bytes = "=" padding.

URL-safe variants often omit padding.

Required by RFC 4648 standard implementations.

What is URL-safe Base64?

URL-safe Base64 (RFC 4648) replaces characters that have special meaning in URLs:

"+" becomes "-",

"/" becomes "_",

and padding "=" is often omitted.

Used in JWT tokens, URL parameters, and filenames.

Standard Base64 breaks URLs because "+/" are reserved.

Both variants encode/decode identically except character substitution.

Also called base64url.

Why does Base64 increase file size?

Base64 increases size by approximately 33% because it encodes 3 bytes (24 bits) into 4 characters (32 bits).

Converts 8-bit bytes to 6-bit chunks (64 possible values).

Math:

3 bytes = 24 bits / 6 bits per character = 4 characters.

Plus padding.

Trade-off for text compatibility.

Avoid for large files unless necessary.

Yes.

Common for small images (<10KB) in CSS/HTML as data URIs:

data:image/png;base64,iVBORw0KG...

Reduces HTTP requests but increases page size 33% and prevents caching.

Good for icons, small logos, embedded SVG.

Bad for photos or large images.

Modern browsers support all formats.

Use image compression first.

Common errors:

Invalid character (not in A-Z, a-z, 0-9, +, /, =),

incorrect padding (wrong number of "="),

truncated input,

wrong variant (standard vs URL-safe),

encoding issues (UTF-8 vs ASCII).

Tools auto-detect and fix most errors.

Check for whitespace, newlines in encoded strings.

Always validate decoded output format.