Submit a tool

What Is Base64 Encoding? (And Why It's Not Encryption)

By Dvir ·

You’ve seen it without knowing its name: the data:image/png;base64,iVBORw0KGgo... at the start of an inline image, the attachment payload buried in a raw email, the blob in a JSON API response. That’s Base64 — one of the most quietly ubiquitous encodings on the internet. It’s simple, useful, and routinely misunderstood in one dangerous way. Let’s clear it up.

The problem Base64 solves

Computers store everything — images, audio, executables — as raw binary bytes, any of the 256 possible values. But a lot of the internet’s plumbing was built for text, and only a safe subset of it. Email headers, URLs, JSON, XML and many protocols can choke on raw binary: certain byte values are control characters, others get mangled by systems that “helpfully” reinterpret line endings or strip high bits.

Base64 is the workaround. It takes arbitrary binary and re-expresses it using only 64 safe characters — A–Z, a–z, 0–9, plus + and / — that survive any text channel intact. Binary goes in; boring, portable text comes out.

You can watch it happen both directions with the Base64 encoder/decoder: type text, see the encoded form; paste encoded text, get the original back.

How it actually works

The mechanism is elegant. Base64 reslices the data by bit count:

  1. Take the input 3 bytes at a time — that’s 24 bits.
  2. Re-split those 24 bits into four 6-bit groups.
  3. Each 6-bit group is a number from 0 to 63 — map it to one of the 64 characters.

So every 3 bytes of input become 4 characters of output. When the input isn’t a multiple of 3, Base64 pads the end with one or two = characters to keep the length a clean multiple of four. That’s why Base64 strings so often end in = or ==.

Why your file gets bigger

Because 3 bytes become 4 characters, Base64 output is always about 33% larger than the original. Encode a 3 MB image and you get roughly 4 MB of text. This is the cost of portability, and it’s worth remembering before you Base64-encode large assets.

It’s also the key trade-off behind inline images. Encoding a small icon directly into your HTML or CSS as a data: URI saves an HTTP request — handy for tiny assets. But do it to a large photo and you’ve inflated it by a third and made it un-cacheable separately. The image-to-Base64 tool is perfect for small icons and lets you see exactly how large the encoded string becomes, so you can judge the trade-off.

The misconception that causes real damage

Here is the single most important thing to understand: Base64 is encoding, not encryption. It provides zero security. There’s no key, no secret, nothing hidden. Anyone can decode any Base64 string in one step — paste it into the decoder and the original pops right out.

Yet people repeatedly treat it as if it conceals something:

  • Storing a password “encoded” in Base64 in a config file — that’s storing it in plaintext with extra steps.
  • Putting sensitive data in a Base64 cookie or URL parameter and assuming it’s protected — it isn’t.
  • “Obfuscating” an API key by Base64-encoding it — trivially reversible.

Base64 makes data transportable, not confidential. If you need confidentiality, you need actual encryption with a key. The only thing Base64 hides data from is a system that can’t handle binary — never from a person.

Base64 vs URL encoding

A related point of confusion: Base64 and URL encoding (percent-encoding) are different tools for different jobs.

  • Base64 makes binary safe for text channels.
  • URL encoding makes text with special characters safe inside a URL, turning a space into %20, an ampersand into %26, and so on.

They even clash slightly: standard Base64 uses + and /, both of which have special meaning in URLs. That’s why there’s a URL-safe Base64 variant that swaps them for - and _ (the same variant JWTs use). If you’re putting data in a query string, you usually want the URL encoder for text, or URL-safe Base64 for binary.

When you’ll actually use it

  • Inline assets — small images or fonts embedded as data: URIs (image-to-Base64).
  • Embedding binary in text formats — files inside JSON, XML or email.
  • Reading encoded payloads — decoding the parts of tokens, cookies or API responses to see what’s inside (Base64 decoder).

And like every tool here, encoding and decoding happen entirely in your browser — whatever you paste, including anything sensitive you’re decoding to inspect, never leaves your device.

The one-line summary

Base64 is a translation layer: it expresses binary data in plain, portable text at a ~33% size cost. It’s everywhere, it’s reversible by anyone, and it secures nothing. Use it to move data through text-only systems — and never, ever as a substitute for encryption.