Is Base64 the same as encryption?

No. Base64 is an encoding scheme, not encryption. Anyone can decode a Base64 string without a key — it is completely reversible. Never use Base64 to protect sensitive data. If you need to hide information, use proper encryption (AES, RSA, etc.). Base64 is only for making binary data safe to transmit through text channels.

Why does Base64 increase file size by 33%?

Base64 groups raw bytes into chunks of 3 (24 bits), then represents each chunk as 4 printable characters (6 bits each). That 3-to-4 byte ratio means every 3 bytes of input produces 4 characters of output — a 33% overhead. Padding characters (=) are added when the input length is not a multiple of 3.

What is Base64url and how is it different?

Base64url is a URL-safe variant of Base64 used in JWTs and other web contexts. It replaces + with - and / with _ to avoid conflicts with URL syntax, and omits the = padding characters. Standard Base64 uses characters that have special meanings in URLs (+, /, =), which would require percent-encoding. Base64url avoids this entirely.

When should I use Base64 encoding?

Use Base64 when you need to transmit binary data through a channel that only supports text: embedding images in HTML or CSS (data URIs), encoding email attachments (MIME), passing binary values in JSON payloads, or storing binary data in cookies or HTTP headers. Do not use it to "compress" data (it does the opposite) or to hide data (it provides no security).

What is Base64 Encoding?

What is Base64?

Base64 is an encoding scheme that converts binary data into a string of printable ASCII characters. It uses an alphabet of 64 characters — A–Z, a–z, 0–9, plus + and / — to represent any sequence of bytes as readable text.

The name comes directly from that alphabet size: 64 symbols, each representing 6 bits of data. It was standardized in RFC 4648 and is used everywhere binary data needs to travel through a text-only channel.

How it works

Base64 processes input in chunks of 3 bytes (24 bits). Each chunk is split into 4 groups of 6 bits. Each 6-bit group maps to one character in the Base64 alphabet:

BytesM
01001101a
01100001n
01101110

6-bit groups010011
T010110
W000101
F101110
u

So Man (3 bytes) encodes to TWFu (4 chars). Every 3 input bytes produce 4 output characters — a 33% size overhead.

Padding

When the input length is not a multiple of 3, Base64 adds = padding characters to make the output length a multiple of 4:

padding examples"Ma" (2 bytes) → "TWE=" (1 padding char) "M" (1 byte) → "TQ==" (2 padding chars) "Man" (3 bytes) → "TWFu" (no padding)

Common use cases

Data URIs — embed images directly in HTML or CSS without a separate file request: src="data:image/png;base64,iVBOR..."
Email attachments (MIME) — email protocols were designed for 7-bit ASCII. Base64 encodes binary attachments so they survive transit.
JSON payloads — JSON only supports text. Binary data (images, files, keys) must be Base64-encoded before being included in a JSON field.
HTTP Basic Auth — credentials are sent as Authorization: Basic base64(user:password).
JWT tokens — each part of a JWT (header, payload, signature) is Base64url-encoded (a URL-safe variant).
Cryptographic keys — PEM files (.pem, .crt) store keys and certificates as Base64-encoded DER data.

Base64 vs Base64url

Standard Base64 uses + and / characters that have special meanings in URLs, requiring percent-encoding. Base64url is a URL-safe variant that solves this:

Base64 (standard)

AlphabetA–Z a–z 0–9 + /

Padding=

Used inFiles, email, data URIs

Base64url (URL-safe)

AlphabetA–Z a–z 0–9 - _

PaddingOmitted

Used inJWTs, OAuth tokens, URLs

What Base64 is NOT

Base64 is not encryption. It is completely reversible without any key. Encoding data in Base64 provides zero security — anyone can decode it in seconds.

Base64 is not compression. It adds ~33% overhead. If you need to reduce size, use gzip or Brotli instead.

Base64 is purely a representation format — it makes binary data safe to handle in text contexts. Nothing more.