You’ve seen it in data: image URLs, API tokens, and email source: long strings of letters, digits, +, /, and trailing =. That’s Base64 — here’s what it actually does and when to reach for it.
What Base64 is (and isn’t)
Base64 encodes binary or text data using just 64 safe ASCII characters. Its whole job is to let data travel through channels that only handle text — without getting corrupted.
- It’s encoding, a reversible format change — not compression and not encryption.
- It hides nothing. Anyone can decode it in a second, so it offers zero security.
- It makes data ~33% larger, the price of being text-safe.
If you remember one thing: Base64 is not a lock. It’s an envelope that anyone can open.
Where it’s used
- Data URLs — embedding a small image directly in HTML/CSS as
data:image/png;base64,…, avoiding a separate network request. - Email (MIME) — attachments are Base64-encoded so binary files survive text-only mail systems.
- Tokens (JWT, API keys) — parts of these are Base64-encoded (again, encoded, not secured).
- Config and data blobs — embedding binary data inside JSON or environment variables.
Encode or decode in your browser
The Base64 Encode / Decode tool handles text and files locally — nothing uploaded:
- Text → Base64 — encode any string, with options for URL-safe output and MIME line wrapping.
- Base64 → Text — decode a string back; it handles URL-safe input and
data:prefixes automatically. - File → Base64 — drop in an image or any file to get a ready-to-paste data URL (or raw Base64).
URL-safe Base64 (Base64URL)
Standard Base64 uses + and /, which have special meaning in URLs. Base64URL swaps them for - and _ and drops the = padding, so the string is safe inside links and filenames. Tick the URL-safe option to produce it; decoding accepts either form.
Working with JSON too?
Base64 blobs often live inside JSON payloads. To clean up or validate that JSON, see how to format and validate JSON and the JSON Formatter.
The bottom line
Base64 makes binary data safe to send as text — perfect for data URLs, email, and tokens. Just never mistake it for security: it’s an envelope, not a lock. Encode and decode it in your browser and keep the data on your device.