What is Base64?
Base64 writes any data, including bytes that are not printable, using only 64 ordinary characters: A to Z, a to z, 0 to 9, plus and slash. It is a way to carry data as text, not a way to hide or protect it.
Action level No action usually needed
- Why you are seeing it
- It shows up as a long string of letters and numbers inside web pages, emails, login headers and data files.
- Why it matters
- It carries any data, including bytes that are not printable, as plain text using only 64 ordinary characters, so it can travel inside text formats.
- What should I do?
- Decode it when you need to read what it holds, with a tool that decodes Base64.
- Do not rely on it to protect a password or a secret, because anyone can decode it in a moment.
- A common misunderstanding
- Base64 is not encryption: it is a way to carry data as text, not a way to hide or protect it.
Encode and decode it yourself
Type some text, then switch between encoding and decoding. This runs in your browser.
SGVsbG8sIE9DQSE=
- Your text
- 11 bytes
- Base64
- 16 characters
- Base64 is an encoding, not encryption: anyone can decode it. It makes bytes safe to carry as plain text, at the cost of about one third more length.
How it works
Base64 takes the data three bytes (24 bits) at a time and cuts it into four pieces of 6 bits. Each piece is a number from 0 to 63, and each number is written as one character from the Base64 alphabet. So three bytes become four characters, and the result is about a third larger than the original.
When the data is not a multiple of three bytes, one or two = signs are added at the end as padding.
| Step | Result |
|---|---|
| Bytes (hex) | 4D 61 6E |
| As bits | 01001101 01100001 01101110 |
| In groups of 6 bits | 010011 010110 000101 101110 |
| As numbers | 19, 22, 5, 46 |
| As characters | T W F u |
A simple example
The text "Hello, OCA!"
It is 11 bytes long.
In Base64 it becomes SGVsbG8sIE9DQSE=, which is 16 characters.
The = at the end is padding, because 11 bytes is not a multiple of three.
Where you meet it
- Images placed directly inside a web page or an email (data URLs).
- The sign-in details in a basic HTTP login header.
- Binary data sent inside text formats such as JSON or XML.
Base64 is not encryption
Anyone can decode Base64 in a moment, with no key. Never use it to protect a password or a secret. A variant called URL-safe Base64 swaps the plus and slash for a dash and an underscore so the text can sit in a web address.
Try these tools
- Base64 Encoder / DecoderTurn text into Base64, or decode Base64 back to text.
Want more detail? Read the longer guide: What is Base64 and how does it work?