Base64 Encode/Decode
Base64 Encode/Decode
Working with JSON or YAML?Data Workbench
What Base64 does, and what it does not
Base64 rewrites arbitrary binary data using only 64 characters that survive being sent through systems that expect text: A–Z, a–z, 0–9, plus and slash. It exists because email, JSON, XML and URLs were all designed to carry text, and handing them raw bytes corrupts the bytes.
It works three bytes at a time. Three bytes are 24 bits; 24 bits split evenly into four 6-bit groups; each 6-bit group indexes one of the 64 characters. That is where the size increase comes from: every 3 bytes in become 4 characters out, so encoded data is always about 33% larger than the original.
Worked examples
| Input | Base64 |
|---|---|
| Hi | SGk=Two bytes, so one = of padding. |
| Sure | U3VyZQ==Four bytes, one over a multiple of 3, so two =. |
| Man | TWFuExactly three bytes, so no padding at all. |
| Hello, world! | SGVsbG8sIHdvcmxkIQ== |
| user:password | dXNlcjpwYXNzd29yZA==The exact form an HTTP Basic auth header carries, and why Basic auth needs TLS. |
The alphabet
| Index | Characters |
|---|---|
| 0–25 | A–Z |
| 26–51 | a–z |
| 52–61 | 0–9 |
| 62 | + (standard) or - (URL-safe) |
| 63 | / (standard) or _ (URL-safe) |
| padding | = |
Worth knowing
- Base64 is an encoding, not encryption. Anyone can decode it, instantly, with no key. It provides zero confidentiality.
- The trailing
=characters are padding. When the input length is not a multiple of 3, the last group is short and is padded out so the output length stays a multiple of 4. One leftover byte gives==, two give=. - The URL-safe variant (RFC 4648 §5) swaps
+for-and/for_, because the standard characters have reserved meanings in URLs and would need percent-encoding. - Base64 inflates data by 4/3. Inlining a 100 kB image as a data URI ships about 133 kB, and it cannot be cached separately from the document that contains it.
Frequently asked questions
- Is Base64 encryption?
- No. Base64 is a reversible encoding with no key and no secret. Anyone who sees the string can decode it in one step. Storing a password Base64-encoded is equivalent to storing it in plain text with an extra inconvenience.
- Why does Base64 output end in equals signs?
- They are padding. Base64 encodes three bytes into four characters, so when the input length is not a multiple of three the final group is incomplete and is padded so the total output length stays a multiple of four. One leftover byte produces two equals signs, two leftover bytes produce one.
- Why is my Base64 string bigger than the original file?
- Because it always is, by about a third. Four output characters carry three input bytes, so the encoded form is 4/3 the size before any line breaks are added. That overhead is the price of being able to send binary data through a text-only channel.
- What is URL-safe Base64?
- A variant that replaces the plus with a hyphen and the slash with an underscore, because those two characters are reserved in URLs and would otherwise need percent-encoding. It is defined in RFC 4648 and is what JSON Web Tokens use for their segments.