Base64 Encoding & Decoding: The Complete Developer Guide

Updated March 2026 · 7 min read

Base64 is one of the most widely used encoding schemes in software development. Every developer encounters it when working with APIs, email systems, data URIs, or authentication tokens. This guide explains what Base64 is, how it works, and when you should (and should not) use it.

What Is Base64 Encoding?

Base64 is a binary-to-text encoding scheme that represents binary data using 64 ASCII characters: A-Z, a-z, 0-9, +, and /, with = used for padding. It converts every 3 bytes of binary data into 4 ASCII characters, resulting in output that is approximately 33% larger than the input.

Original:  Hello, World!
Base64:    SGVsbG8sIFdvcmxkIQ==

Original:  DevToolKit
Base64:    RGV2VG9vbEtpdA==

How Base64 Encoding Works

1. Take the input bytes and split them into groups of 3 bytes (24 bits).
2. Divide each 24-bit group into four 6-bit segments.
3. Map each 6-bit value to a character in the Base64 alphabet (0=A, 25=Z, 26=a, 51=z, 52=0, 61=9, 62=+, 63=/).
4. If the input length is not a multiple of 3, pad the output with = characters.

Text:    H        e        l
ASCII:   72       101      108
Binary:  01001000 01100101 01101100
6-bit:   010010 000110 010101 101100
Base64:  S      G      V      s

When to Use Base64 Encoding

1. Data URIs (Embedding Images in HTML/CSS)

Base64 lets you embed small images directly in HTML or CSS, eliminating extra HTTP requests:

<img src="data:image/png;base64,iVBORw0KGgo..." />

/* CSS */
.icon {
  background-image: url(data:image/svg+xml;base64,PHN2Zy...);
}

This is most useful for small icons under 10KB. Larger images are better served as separate files since Base64 increases size by 33%.

2. JWT Tokens

JSON Web Tokens use Base64URL encoding (a URL-safe variant) for the header and payload sections. When you decode a JWT, you are Base64-decoding each dot-separated segment:

// JWT structure: header.payload.signature
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

// Decoded header (Base64URL):
{"alg":"HS256"}

// Decoded payload (Base64URL):
{"sub":"1234567890"}

3. HTTP Basic Authentication

The HTTP Authorization: Basic header encodes credentials as Base64:

// username:password -> Base64
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

// This decodes to: username:password

Important: Base64 is encoding, not encryption. Anyone can decode it. Always use HTTPS when sending Basic auth headers. Check your SSL certificate to ensure your connection is encrypted.

4. Email Attachments (MIME)

Email protocols (SMTP) were designed for 7-bit ASCII text. Binary attachments like PDFs or images are Base64-encoded to travel safely through email servers.

5. Storing Binary Data in JSON or XML

Since JSON and XML are text-based, binary data (images, files, certificates) must be Base64-encoded to be embedded in these formats.

Base64 in Different Programming Languages

# Python
import base64
encoded = base64.b64encode(b"Hello").decode()  # "SGVsbG8="
decoded = base64.b64decode("SGVsbG8=").decode()  # "Hello"

// JavaScript (Browser)
btoa("Hello")          // "SGVsbG8="
atob("SGVsbG8=")       // "Hello"

// Node.js
Buffer.from("Hello").toString("base64")         // "SGVsbG8="
Buffer.from("SGVsbG8=", "base64").toString()    // "Hello"

// Bash
echo -n "Hello" | base64          # SGVsbG8=
echo "SGVsbG8=" | base64 -d       # Hello

Base64 vs Base64URL

Base64URL avoids characters that have special meaning in URLs and file systems, making it safe for query parameters and path segments.

Common Mistakes with Base64

• Using Base64 for security — Base64 is not encryption. It provides zero security. Use it for encoding, not protecting data.
• Base64-encoding large files — The 33% size overhead is wasteful for large payloads. Use proper binary transfer instead.
• Double encoding — Encoding an already Base64-encoded string produces garbage. Always check if your data is already encoded before processing it.
• Ignoring character encoding — Always know whether your input is UTF-8, ASCII, or another encoding. Different encodings produce different Base64 output for the same visible text.

FAQ

Is Base64 encoding the same as encryption?

No. Base64 is trivially reversible by anyone. It is an encoding scheme, not a security mechanism. For actual security, use proper encryption algorithms and generate strong passwords or use cryptographic hashes.

Why does Base64 output end with = or ==?

The = padding ensures the output length is always a multiple of 4. One = means the last group had 2 bytes; == means it had 1 byte. No padding means the input length was already a multiple of 3.

Can I Base64-encode binary files?

Yes. Base64 works with any binary data, including images, PDFs, and executables. The DevToolKit Base64 tool supports both text and file encoding.

What is the maximum size for Base64 encoding?

There is no theoretical limit, but practical limits depend on memory. For browser-based tools, files up to 10-50MB work well. For larger files, use command-line tools.

DevToolKit — 42+ Free Online Developer Tools