What Is Base64?

Base64 in one paragraph

Base64 is a way to write any binary data using only 64 printable characters. It lets images, files, keys and any bytes travel through channels made for text, such as email, JSON, XML, HTML and HTTP headers. It is an encoding, not encryption and not compression: it can be reversed by anyone and it makes data about one third bigger.

The Base64 alphabet

64 characters need exactly 6 bits (2⁶ = 64), which is why the name is Base64.

How it works

1. Take the data as bytes (8 bits each).
2. Join the bits and cut them into groups of 6 bits. Three bytes (24 bits) give exactly four groups.
3. Look up each 6-bit value in the alphabet.
4. If the data does not fill the last group of three bytes, add zero bits and finish with = to reach a multiple of 4 characters.

See every step for your own text in the text to Base64 converter.

Why the size grows by 33%

Three bytes become four characters, so the output is 4/3 of the input: a 3 MB file becomes about 4 MB. The exact length is 4 × ceil(n / 3) characters for n bytes, plus line breaks if you use them. With gzip compression on a web server, the extra size is partly recovered, but compressing the original file is always better.

What the = padding means

The padding only tells the decoder how many bytes the last group holds: == means one byte, = means two bytes, none means three. It carries no data, so many formats (JWT, URLs) leave it out and the decoder works the length out itself. A length that leaves one extra character (length % 4 == 1) is never valid.

Variants of Base64

Where Base64 is used

• Email (MIME) to carry attachments and non-ASCII text.
• Data URIs to put small images, fonts and files inside HTML or CSS. See image to Base64.
• JSON and XML APIs to carry files and binary values, because these formats have no binary type.
• HTTP Basic authentication: Authorization: Basic plus the Base64 of user:password. This is not protection, so always use HTTPS.
• JWT and other tokens, written in Base64URL.
• Certificates and keys in PEM files.

What Base64 is not

• Not encryption. It has no key and no secret. A password in Base64 is a password in plain sight.
• Not compression. It always makes data larger.
• Not URL encoding. URL encoding keeps text readable and escapes unsafe characters as %XX. Base64 changes all of the data.
• Not a hash. A hash cannot be reversed. For that, see the hash generator.

Encode and decode in 7 languages

// JavaScript (browser) - UTF-8 safe
const bytes = new TextEncoder().encode('café');
const b64 = btoa(String.fromCharCode(...bytes));          // "Y2Fmw6k="
const text = new TextDecoder().decode(Uint8Array.from(atob(b64), c => c.charCodeAt(0)));

// Node.js
Buffer.from('café').toString('base64');
Buffer.from('Y2Fmw6k=', 'base64').toString('utf8');

// PHP
base64_encode('café');   base64_decode('Y2Fmw6k=');

# Python
import base64
base64.b64encode('café'.encode()).decode();   base64.b64decode('Y2Fmw6k=').decode()

// Java
Base64.getEncoder().encodeToString("café".getBytes(StandardCharsets.UTF_8));
new String(Base64.getDecoder().decode("Y2Fmw6k="), StandardCharsets.UTF_8);

// C#
Convert.ToBase64String(Encoding.UTF8.GetBytes("café"));
Encoding.UTF8.GetString(Convert.FromBase64String("Y2Fmw6k="));

# Shell
printf 'café' | base64          # encode
echo 'Y2Fmw6k=' | base64 -d     # decode

Common errors and how to fix them

• InvalidCharacterError from btoa(): the text has characters above U+00FF. Convert to UTF-8 bytes first.
• "Invalid character" or "Illegal base64 character": there are quotes, spaces, the data: prefix, or URL-safe characters. Clean the text, or use the Base64 decoder, which reports the position.
• "Incorrect padding": the padding is missing. Add = until the length is a multiple of 4.
• The result has an extra line break: the command added a newline. Use printf or echo -n.
• Garbled text after decoding: wrong charset, or the data is binary. See Base64 to text.
• The line wraps and breaks a header or JSON: encode with no line breaks (base64 -w 0).

Security notes

• Never rely on Base64 to hide secrets or to sanitise input. Attackers use it to hide payloads, so decode and validate untrusted input before you use it.
• Check the size of decoded data before you allocate memory for it, to avoid denial-of-service with huge inputs.
• Validate the type of a decoded file (see the first bytes in Base64 to image) and do not trust the name or the MIME type that came with it.

All Base64 tools on this site

• Base64 encode and Base64 decode
• Text to Base64 and Base64 to text
• Image to Base64 and Base64 to image
• Base64URL encode and Base64URL decode