Base64 Encode & Decode

How Base64 Encoding Works

Base64 is a binary-to-text encoding scheme defined by RFC 4648. It is not encryption, not compression, and not a security mechanism of any kind — it exists purely to make binary data safe to carry through systems that were designed to handle text, not raw bytes. Email systems, JSON strings, HTML attributes, and many older protocols choke on arbitrary binary bytes, especially control characters or byte sequences that could be misinterpreted as protocol commands. Base64 sidesteps that by remapping every 3 bytes of input into 4 characters drawn from a 64-character alphabet of letters, digits, and a couple of symbols — all of which are guaranteed safe to pass through text-oriented systems unmodified.

The tradeoff is size: because each output character only carries 6 bits of information instead of 8, Base64-encoded data is about 33% larger than the original. That overhead is the price of universal text-safety, and it's why Base64 is reserved for cases where binary-in-text is genuinely necessary rather than used as a general-purpose storage format. Typical real-world uses include embedding small images directly into HTML or CSS as data URIs (avoiding a separate image request), packaging binary file attachments inside JSON API payloads, and constructing HTTP Basic Authentication headers, where a username:password pair is Base64-encoded (again, not encrypted) before being sent over an already-encrypted HTTPS connection.

One of the most common places developers encounter Base64 today is inside JSON Web Tokens. A JWT is three segments — header, payload, and signature — each independently Base64url-encoded and joined with dots. Base64url is a small variant of standard Base64 that swaps out the + and / characters (which have special meaning in URLs) for - and _, and typically drops the trailing = padding. If you're working with tokens rather than plain text, the JWT Decoder tool applies this same decoding logic automatically to each segment and shows you the resulting JSON, rather than requiring you to split and decode the token by hand.

Because decoding a Base64 string requires no key, password, or special knowledge — just the string itself and a decoder — it should never be relied on to keep data confidential. It is entirely reversible by design, and that reversibility is a feature, not a flaw: the entire point is that data survives the round trip through a text-only system unmodified. If you need to keep information private, encrypt it first with something like AES, then Base64-encode the encrypted bytes if you need the result to be text-safe. Encoding and encryption solve different problems, and mixing them up is one of the most common misunderstandings developers have about Base64.