Base64 shows up everywhere — in JWT tokens, email attachments, data URIs, API payloads, and SSH keys. It is not encryption, not compression, and not magic. It is simply a way to represent binary data as printable text. This guide explains exactly how it works, when to use it, and how to encode or decode anything in seconds.
What is Base64?
Base64 is a binary-to-text encoding scheme that converts binary data into 64 printable ASCII characters: A–Z, a–z, 0–9, +, and /. Every 3 bytes of input become 4 Base64 characters, making the encoded output roughly 33% larger than the original. The name “Base64” comes from this alphabet of 64 characters.
The purpose is simple: many systems — email servers, HTTP headers, JSON fields, URLs — were designed to handle text only. Base64 lets you safely pass binary data (images, files, keys, binary blobs) through those text-only channels without corruption.
Standard vs URL-safe Base64
Standard Base64 (RFC 4648) uses + and / in its alphabet. Both of those characters have special meaning in URLs — + decodes as a space in query strings, and / is a path separator. Pasting a standard Base64 string into a URL breaks it.
URL-safe Base64 solves this by replacing + with -and / with _, and omitting the = padding. This variant is safe to embed in URLs, filenames, and HTTP headers with no percent-encoding. JWT tokens, OAuth state parameters, and many modern API tokens use URL-safe Base64.
When to use Base64
Common real-world uses include: embedding images in HTML/CSS as data URIs (data:image/png;base64,…), encoding file attachments in email (MIME), passing binary data in JSON API fields, storing public keys in PEM files, and encoding credentials in HTTP Basic Auth headers (Authorization: Basic dXNlcjpwYXNz).
Base64 is not suitable for: hiding sensitive data (anyone can decode it without a key), compressing data (it makes files larger, not smaller), or any security purpose requiring confidentiality.
How to decode a JWT
A JSON Web Token consists of three URL-safe Base64 segments joined by dots: header.payload.signature. The header and payload are Base64url-encoded JSON objects; the signature is a cryptographic hash. To read the claims inside a JWT, paste it into the Base64 decoder in decode mode — it auto-detects the JWT structure and displays the header and payload as formatted JSON. Note: decoding a JWT does not verify the signature.
How to decode a Base64 image
Data URIs embed images directly in HTML: <img src="data:image/png;base64,..." />. To extract and preview the image, paste the full data URI (or just the Base64 portion) into the decoder. The tool detects the MIME type and displays a live image preview. You can then download the image file directly.
Size overhead
Every 3 bytes become 4 Base64 characters, so the encoded output is always ⌈n / 3⌉ × 4 characters — approximately 33% larger than the input. Padding (= or ==) fills the last group to a multiple of 4. For files, this overhead is the cost of making binary data text-safe.
Encode or decode Base64 instantly in your browser:
Open Base64 Encoder/Decoder →